WordPress Plugin Vulnerabilities

TablePress < 3.3.2 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Affects Plugins

Plugin icon
tablepress
Fixed in 3.3.2

References

CVE
CVE-2026-56051
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c30aeafe-725b-47be-b49d-00f58b474c3a

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
Bonds
Verified
No
WPVDB ID
2999cb08-5c97-43ed-a926-5dd91af1ab71

Timeline

Publicly Published
2026-06-25 (about 1 month ago)
Added
2026-06-30 (about 1 month ago)
Last Updated
2026-06-30 (about 1 month ago)

Other

Published
Title
Published
2024-07-10
Title
Tutor LMS < 2.7.3 - Authenticated (Tutor Instructor+) Stored Cross-Site Scripting
Published
2024-03-28
Title
Better Elementor Addons < 1.4.2 - Contributor+ Stored XSS
Published
2024-07-16
Title
WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS
Published
2022-11-03
Title
Google Forms <= 0.95 - Admin+ Stored XSS
Published
2024-03-26
Title
WP-Lister Lite for Amazon < 2.6.12 - Authenticated (Administrator+) Stored Cross-Site Scripting