What is the CVSS score of CVE-2026-56051?

CVE-2026-56051 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of TablePress are affected by CVE-2026-56051?

TablePress WordPress plugin versions 3.3.1 and earlier contain a high-severity cross-site scripting vulnerability (CVSS 7.1) that allows unauthenticated attackers to steal administrator credentials…

How to fix or mitigate CVE-2026-56051?

Within 24 hours: Disable or completely remove TablePress plugin versions 3.3.1 and earlier from all affected WordPress installations; audit WordPress logs for suspicious admin activity or unauthorized changes. Within 7 days: Deploy Web Application Firewall rules to block reflected XSS payloads targeting TablePress; implement IP-based access restrictions to the WordPress admin dashboard. Within 30 days: Monitor Patchstack and the WordPress plugin repository for TablePress security updates; test any released patches in a staging environment before production deployment; conduct a comprehensive security review of systems that ran the vulnerable plugin.

TablePress CVE-2026-56051

EUVD-2026-39381 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-6pgh-2p78-w4fh

WordPress XSS Tablepress Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Network-reachable unauthenticated reflected XSS needing victim interaction (UI:R) with scope change (S:C); confidentiality/integrity low via session abuse, no real availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:23 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

AnalysisAI

Reflected cross-site scripting in the TablePress WordPress plugin (versions 3.3.1 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, including the WordPress admin session context. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported through Patchstack's WordPress vulnerability program.

Technical ContextAI

TablePress is a widely installed WordPress plugin used to create and manage HTML tables in posts and pages. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected back into a response without proper output encoding or sanitization, allowing HTML/JavaScript injection. The affected CPE is cpe:2.3:a:tablepress:tablepress (all versions through 3.3.1). As a reflected XSS, the malicious payload is delivered in the request (e.g., a URL parameter) and echoed into the page rather than stored, so each attack requires the victim to trigger the crafted request.

RemediationAI

Upgrade TablePress to the first release after 3.3.1 that addresses this issue; the input does not state an exact fix version, so confirm the patched version from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tablepress/vulnerability/wordpress-tablepress-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability) or the TablePress changelog before upgrading. Until patched, place the site behind a Web Application Firewall (e.g., Patchstack or equivalent virtual patching) and add rules to filter script/HTML metacharacters in requests to TablePress endpoints - note this can produce false positives on legitimately HTML-containing table data. As reflected XSS is delivered via crafted links, also enforce a restrictive Content-Security-Policy to limit inline script execution and educate administrators not to follow untrusted links to the WordPress site; if the plugin is not actively used, deactivate and remove it to eliminate exposure.