WordPress Plugin Vulnerabilities

TableOn < 1.0.1 - Reflected Cross-Site Scripting

Description

The plugin does not sanitise or escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting issues

Proof of Concept

Affects Plugins

Plugin icon
posts-table-filterable
Fixed in 1.0.1

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
b2a5b71e-0ae7-4aab-8f99-31247925f7d5

Timeline

Publicly Published
2021-10-18 (about 4 years ago)
Added
2021-10-18 (about 4 years ago)
Last Updated
2021-10-18 (about 4 years ago)

Other

Published
Title
Published
2024-10-08
Title
CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings
Published
2024-05-06
Title
AWSOM News Announcement <= 1.6.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-04-11
Title
Wireless Butler <= 1.0.11 - Reflected Cross-Site Scripting
Published
2023-05-02
Title
Add to Feedly <= 1.2.11 - Admin+ Stored XSS
Published
2025-01-16
Title
Blrt WP Embed <= 1.6.9 - Reflected Cross-Site Scripting