The Posts Table with Search & Sort plugin contains a stored Cross‑Site Scripting flaw that is enabled by the date_format attribute of its shortcode. Because the plugin does not properly escape or sanitize this input and the injected payload bypasses WordPress’s wp_kses_post filter (by omitting literal angle brackets), an authenticated contributor or higher can store malicious content in the database. When a visitor loads a page that renders the stored date_format value, the malicious script executes in the victim’s browser, potentially leading to session hijacking, defacement, or distribution of malware. The flaw is a classic stored XSS (CWE‑79).

The vulnerability affects the Barn2 Media "Posts Table with Search & Sort" WordPress plugin, any installation using version 1.4.14 or earlier. No additional platform or operating‑system details are disclosed, but the plugin runs on standard WordPress installations.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is available, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no documented active exploitation at the time of this report. The attack requires only authenticated access at the contributor level or higher; once the payload is stored, it affects all site visitors who view the rendered page. This makes the threat realistic and potentially widespread on sites that have not applied a fix or mitigations.