The Sheets2Table WordPress plugin contains a stored cross‑site scripting flaw in the titles shortcode attribute of the [sheets2table-render-table] shortcode. Input from the 'titles' field is trimmed but not sanitized or escaped before being inserted into a <th> element, allowing an attacker to embed arbitrary JavaScript that will run for any user who views a page containing the injected table. This flaw grants authenticated users with Contributor privileges – a role that can edit and publish content – the ability to compromise the confidentiality and integrity of the site by injecting malicious scripts.

Any WordPress installation using the Sheets2Table plugin version 0.4.1 or earlier is affected. The weakness exists within the plugin’s core files – class‑sheets2table‑tables.php and sheets2table‑shortcodes.php – and requires that the user have at least Contributor access to the site to exploit.

The CVSS base score is 6.4, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is authenticated, meaning a user must be logged in with Contributor or higher privileges. The exploitation path is straightforward: an attacker crafts a malicious titles attribute in the shortcode, publishes the content, and any site visitor will execute the injected code. Consequently, the risk is high for sites that allow contributors to add or edit content.