Executive brief
TablePress, a popular WordPress plugin used for creating and managing tables, contains a security flaw that allows attackers to inject malicious scripts into a website. If a site administrator or visitor clicks on a specially crafted link, the attacker could potentially hijack their session, redirect them to malicious websites, or deface the site. This vulnerability can be exploited by unauthenticated users, posing a risk to the site's reputation and user data.
Technical details
TablePress versions 3.3.1 and earlier are vulnerable to reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by tricking a user into clicking a malicious link or visiting a crafted URL. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized actions. The issue is resolved in version 3.3.2.
Affected products
- TablePress TablePress <= 3.3.1
Timeline
- 2026-06-06: other: Reported by researcher Bonds
- 2026-06-25: disclosed
- 2026-06-25: patched: Patch released in version 3.3.2