Skip to main content

TablePress CVE-2026-56051

| EUVDEUVD-2026-39381 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-06-25 Patchstack GHSA-6pgh-2p78-w4fh
XSS Tablepress
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
6.1 MEDIUM

Network-reachable unauthenticated reflected XSS needing victim interaction (UI:R) with scope change (S:C); confidentiality/integrity low via session abuse, no real availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
Analysis Generated
Jun 25, 2026 - 14:23 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.

AnalysisAI

Reflected cross-site scripting in the TablePress WordPress plugin (versions 3.3.1 and earlier) lets an unauthenticated attacker inject script that executes in a victim's browser when they follow a crafted link. Because the CVSS scope is changed (S:C), successful exploitation can affect resources beyond the vulnerable component, including the WordPress admin session context. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious TablePress URL with script payload
Delivery
Deliver link to victim via phishing
Exploit
Victim loads page, payload reflected unsanitized
Execution
Script executes in victim browser session
Impact
Hijack session or act as user
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires no authentication (PR:N) but does require victim user interaction (UI:R) - a target must open an attacker-crafted link or request that reaches the vulnerable TablePress code path on a site running version 3.3.1 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-reachable, low-complexity, unauthenticated attack that nonetheless requires user interaction (UI:R) - a victim must click or load a malicious link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a URL to the WordPress site containing a malicious script payload in a parameter handled by TablePress and distributes it (phishing email, malicious post, or social media). When a logged-in administrator or other user opens the link, the script reflects into the page and runs in their browser session, potentially stealing the session cookie or performing actions on their behalf. …
Remediation Upgrade TablePress to the first release after 3.3.1 that addresses this issue; the input does not state an exact fix version, so confirm the patched version from the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tablepress/vulnerability/wordpress-tablepress-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability) or the TablePress changelog before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Disable or completely remove TablePress plugin versions 3.3.1 and earlier from all affected WordPress installations; audit WordPress logs for suspicious admin activity or unauthorized changes. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Tablepress

View all
CVE-2024-23825 MEDIUM POC
4.9 Jan 30

TablePress is a table plugin for Wordpress. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable
CVE-2024-4354 MEDIUM
6.4 Jun 07

The TablePress - Tables in WordPress made easy plugin for WordPress is vulnerable to Server-Side Request Forgery in all

CVE-2025-2685 MEDIUM
6.4 Mar 27

The TablePress - Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
CVE-2024-9595 MEDIUM
5.4 Oct 12

The TablePress - Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the
CVE-2017-10889 MEDIUM
4.3 Nov 17

TablePress prior to version 1.8.1 allows an attacker to conduct XML External Entity (XXE) attacks via unspecified vector
CVE-2025-5096 MEDIUM
6.4 May 23

The TablePress plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the 'data-caption', 'data

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2026-56051 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy