What is the CVSS score of CVE-2026-6237?

CVE-2026-6237 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Quick Table WordPress Plugin CVE-2026-6237

EUVD-2026-29401 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-4qcm-53jg-8wv4

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The Quick Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' attribute of the 'qtbl' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored cross-site scripting in Quick Table plugin for WordPress allows authenticated contributors and above to inject malicious scripts via the 'style' attribute of the 'qtbl' shortcode, which execute when any user views the affected page. The vulnerability affects all versions up to 1.0.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

The Quick Table WordPress plugin processes user-supplied shortcode attributes without adequate sanitization or escaping. The 'qtbl' shortcode specifically fails to sanitize the 'style' attribute before rendering it in HTML output, creating a stored XSS vector. This is a classic implementation flaw in shortcode handler design where user input intended for styling is rendered directly into the DOM without stripping or escaping HTML metacharacters. The vulnerability exists in the shortcode processing logic (referenced at qtbl.php line 30 in the WordPress plugin repository) where attribute values are incorporated into page output. CWE-79 (Improper Neutralization of Input During Web Page Generation) classifies the root cause as insufficient input validation combined with missing output encoding.

RemediationAI

Update the Quick Table plugin to a patched version as provided by the plugin author; however, no specific patched version has been independently confirmed in the provided data. Site administrators should immediately disable or remove the Quick Table plugin until a security update is available from the plugin developer. As a temporary compensating control, restrict the 'qtbl' shortcode usage to pages and posts created only by site administrators, preventing contributor-level users from adding or modifying shortcodes via WordPress role-based access controls or a content filtering plugin. Additionally, implement a Web Application Firewall (WAF) rule to detect and block script tags and event handlers in shortcode attributes, though this is labor-intensive and may break legitimate styling. Monitor for suspicious pages or posts recently modified by contributors, and audit existing content for signs of injected scripts (presence of <script> tags or on* event attributes in shortcode usage).