The vulnerability arises from insufficient sanitization of the ‘shortcode_debug’ parameter in the TablePress plugin. An authenticated attacker with Contributor-level access can embed malicious scripts that are stored in the plugin’s database. When other site users load the affected page, the injected scripts execute in their browsers, potentially compromising session data, defacing content, or facilitating phishing attacks. This flaw aligns with CWE‑79: Injection: Improper Neutralization of Input During Web Page Generation.

The plugin known as TablePress, made popular by the vendor tobiasbg, is affected in all releases up through version 3.2. WordPress sites running any of those versions and granting Contributor or higher permissions are vulnerable. Users should verify the plugin version and update accordingly.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % signals that the vulnerability is not widely exploited in the public space. It is not listed in the CISA KEV catalog, suggesting no known active exploitation reports. The attack vector requires authenticated access with at least Contributor privileges, which are often granted to content authors. Once exploited, the embedded script runs in the context of any visitor to the affected page, expanding the potential impact across the site’s user base.