The Smart Table Builder plugin for WordPress is vulnerable to a stored cross‑site scripting flaw because the ‘id’ parameter is neither sanitized nor escaped before being persisted. An authenticated user with Contributor level or higher can insert arbitrary scripts that are later rendered when a page containing the stored value is viewed, allowing the attacker to execute code in the victim’s browser environment. This can result in cookie theft, session hijacking, defacement, or the execution of further malicious actions on behalf of the victim.

The vulnerability exists in all releases of the Smart Table Builder plugin by designful up to and including version 1.0.1. WordPress sites that have installed or are running these versions and that have users with Contributor or higher permissions are at risk.

The vulnerability scores a CVSS of 6.4 and has a very low EPSS score (<1 %). It is not listed in the CISA KEV catalog. Attack requires authentication as a Contributor or higher; the attacker must supply a crafted ‘id’ value in the plugin’s interface, which is then stored and later sent out to visitors of the affected page. Because the flaw is confined to authenticated users, it is less likely to be widely exploited, but once an attacker gains Contributor access the impact is immediate for any user visiting the maliciously crafted page.