WordPress Plugin Vulnerabilities

TablePress < 3.2.1 - Contributor+ Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
tablepress
Fixed in 3.2.1

References

CVE
CVE-2025-9500
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
Muhammad Yudha - DJ
Verified
No
WPVDB ID
659753e7-7845-470d-b9c3-b554b884b727

Timeline

Publicly Published
2025-08-29 (about 8 months ago)
Added
2025-09-01 (about 8 months ago)
Last Updated
2025-09-01 (about 8 months ago)

Other

Published
Title
Published
2021-07-30
Title
Nifty Newsletters <= 4.0.23 - CSRF to Stored XSS
Published
2021-09-20
Title
YITH WooCommerce Product Add-Ons < 2.1.0 - Reflected Cross-Site Scripting
Published
2024-04-05
Title
WPvivid Backup for MainWP < 0.9.34 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2024-12-11
Title
FormFacade < 1.3.7 - Reflected Cross-Site Scripting
Published
2023-04-01
Title
Weaver Show Posts < 1.7 - Contributor+ Stored Cross-Site Scripting