This vulnerability stems from inadequate sanitization of the tableon_button shortcode attributes, notably class, help_link, popup_title and help_title. An attacker with Contributor or higher privileges can craft a malicious value for the class attribute, which the plugin concatenates into the HTML output without escaping. The result is stored XSS; when any user visits a page containing the injected shortcode, the malicious script runs in that user’s browser, potentially leading to defacement, session hijacking, or the delivery of phishing payloads. This attack does not compromise the server directly but can compromise the confidentiality, integrity, and authenticity of all site users who access the affected pages.

The flaw affects the TableOn – WordPress Posts Table Filterable plugin for WordPress, versions up to and including 1.0.4.4. Any WordPress site running this plugin version and granting Contributor or higher roles to users is susceptible.

The CVSS score of 6.4 reflects a moderate impact, and the EPSS score is not available, so the probability of exploitation in the wild is unclear. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and the only identified vector is through authenticated users who can insert the shortened code. If such users are present on the site, the risk remains present until the plugin is upgraded or the usage of the affected shortcode is removed.