The vulnerability arises because the plugin’s wptb shortcode does not sanitize or escape user‑supplied attributes. This omission allows authenticated users with contributor‑level access to embed JavaScript code that is persisted in the database and executed whenever any user views a page containing the shortcode. The stored cross‑site scripting flaw is a classic example of CWE‑79 and can be used to deface content, steal credentials, or inject malware.

All WordPress installations that have the WP Table Builder – Drag & Drop Table Builder plugin installed in versions 2.0.12 or earlier are impacted. Users with contributor privilege or higher can exploit the issue. No other versions are known to be affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of less than 1% suggests exploitation is unlikely but not impossible. Because the flaw requires authenticated access with contributor role, the threat is limited to sites with users that can edit tables, yet the impact once exploited can affect all visitors. The vulnerability is not listed in the CISA KEV catalog, so no publicly known exploits are reported at this time.