The vulnerability is an unauthenticated reflected cross‑site scripting flaw in TablePress versions up to and including 3.3.1. An attacker can embed arbitrary scripts that will execute in the web browser of any visitor to a page that uses TablePress, potentially resulting in session hijacking, defacement, or supply‑chain attacks. The weakness is a classic input validation failure identified as CWE‑79.

The affected product is the WordPress TablePress plugin, version 3.3.1 and earlier. No specific operating system or PHP version constraints are listed, but the plugin runs on all WordPress sites that have not been updated to 3.3.2 or later.

The CVSS score of 7.1 reflects a high‑severity vulnerability that is exploitable without authentication, making it easy for attackers to target any visitor. The lack of an EPSS score indicates that no quantitative exploitation probability is provided, and KEV shows it is not listed in CISA’s known exploited vulnerabilities catalog. The attack vector is a web‑based request to a TablePress‑enabled page, and the vulnerability can be triggered by any user who visits a crafted URL.