CVE-2026-6237

Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

View on CVE.org
Published May 12, 2026 CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Description
The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Analysis

AI-generated

Technical impact

The Vulnerability is a stored cross‑site scripting flaw triggered when users with contributor‑level or higher authority insert malicious content through the 'style' attribute of the qtbl shortcode. The insufficient sanitization allows arbitrary JavaScript to be written to the page, which will execute in the browsers of any visitor viewing the affected page. This can lead to theft of user credentials or session data, defacement of content, and possible lateral movement within the site.

Affected Systems

This flaw affects the Quick Table plugin by rdcravens, versions up to and including 1.0.0. Any WordPress installation that has this plugin installed (and is not patched to a newer release) is vulnerable.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.4, indicating a high impact with an authentication requirement. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers need legitimate contributor+ credentials to exploit the flaw, after which they can inject and store malicious scripts, causing the code to run on subsequent page views by other site visitors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Quick Table to a version that implements proper sanitization of the style attribute (e.g., 1.0.1 or newer).
  • If an update is not immediately possible, remove or disable the qtbl shortcode from the site or configure a plugin filter to strip the style attribute.
  • Review user roles to limit contributor+ access to only trusted users and audit for any unexpected script injections.

Generated by OpenCVE AI on May 12, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Rdcravens
Rdcravens quick Table
Wordpress
Wordpress wordpress
Vendors & Products Rdcravens
Rdcravens quick Table
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Title Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
Wordfence
Published
Updated
May 12, 2026, 9:14 PM
Reserved
Apr 13, 2026, 4:53 PM

View source JSON

Updated
May 12, 2026, 9:14 PM

JSON

Status
Deferred
Published
May 12, 2026, 9:16 AM
Modified
Jun 17, 2026, 11:00 AM

View source JSON

No data.

Updated
May 13, 2026, 10:39 AM

JSON