FlexTable Google Sheets Connector < 3.19.2 – Admin+ Stored XSS | CVE 2025-9543

Description

The plugin does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Proof of Concept

1. Create a new table in Google Sheets.
2. Add the following payload in a cell: https://example.com?s=<script>alert('XSS')</script>.
3. In the plugin, create a new table and enter the link to Google Sheet above (e.g https://docs.google.com/spreadsheets/xxxxxx/edit?gid=0#gid=0).
4. In the "Table Customization" tab of the plugin, go to the "Utility" section and enable the "Import links from sheet" box and save the settings.
5. Create a new page and add the shortcode of the table.
6. Access the page, and the JS payload will be executed.