CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
The WP Get The Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in WP Get The Table WordPress plugin versions up to 1.5 allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the 'url' parameter due to insufficient input sanitization and output escaping. Injected scripts execute whenever any user accesses the affected pages, potentially compromising site visitors and enabling account hijacking, malware distribution, or data theft. No public exploit code or active exploitation has been confirmed at time of analysis, but the vulnerability requires only contributor-level access and has a moderate CVSS score of 6.4 reflecting limited technical complexity and network-based attack vector.
Technical ContextAI
WP Get The Table is a WordPress plugin that processes and displays table data. The vulnerability exists in the plugin's handling of the 'url' parameter, which fails to properly sanitize user input before storage in the WordPress database and fails to apply adequate output escaping when rendering the parameter in page content. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where untrusted user input is persisted server-side and later executed in the context of other users' browsers. The vulnerability affects all versions through 1.5 and likely stems from direct use of unsanitized $_POST or $_GET parameters without WordPress security functions like sanitize_text_field() or wp_kses_post() during input handling, and missing escaping functions like esc_url() or esc_attr() during output rendering.
Affected ProductsAI
WP Get The Table WordPress plugin versions up to and including 1.5 are affected. The plugin is available via the official WordPress Plugin Repository at https://wordpress.org/plugins/wp-get-the-table/. All installations using version 1.5 or earlier should be considered vulnerable. The vulnerability impacts any WordPress site where untrusted contributors have been granted contributor-level or higher permissions.
RemediationAI
Update WP Get The Table to a patched version released after vulnerability disclosure. Consult the official plugin repository at https://wordpress.org/plugins/wp-get-the-table/#developers and https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3333917%40wp-get-the-table&new=3333917%40wp-get-the-table for the latest available version. As an interim mitigation, restrict contributor-level access to only trusted users, and consider temporarily disabling the WP Get The Table plugin if version updates are unavailable. WordPress administrators should audit the plugin's settings and any pages or posts using the plugin's functionality to identify potential XSS payloads that may have already been injected.
Share
External POC / Exploit Code
Leaving vuln.today