TableOn EUVD-2026-112738

Exploitation requires an attacker to deliver a crafted request/link to a user and for that user to interact with it (CVSS UI:R) - reflected XSS is not self-triggering and cannot be launched silently against the server, which is the primary limiting factor. No authentication is required of the attacker (PR:N), and the flaw is reachable over the network against sites running the TableOn (posts-table-filterable) plugin at version 1.0.7 or earlier. The available advisory does not name the exact vulnerable parameter, page, or whether any non-default plugin configuration (e.g., a specific shortcode or filterable table being rendered) is needed to reach the vulnerable sink; that trigger is not described in the available sources. Realistic impact is bounded to actions performable in the victim's browser session on the affected site.

This is a reflected cross-site scripting flaw (CWE-79) in the PluginUs.Net TableOn 'posts-table-filterable' WordPress plugin, affecting versions up to and including 1.0.7. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates a network-reachable, low-complexity, unauthenticated flaw that nevertheless requires user interaction (UI:R) - the victim must follow an attacker-crafted request/link - which materially lowers real-world exploitability compared with a server-side RCE of similar score. No EPSS probability is supplied in the input, and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; the only signal of elevated attention is Patchstack's 'this_week' priority label, which reflects triage urgency rather than confirmed in-the-wild activity. The single reference is a Patchstack advisory entry, not verified working exploit code. Taken together, the signals are consistent with a moderate-severity, user-interaction-gated web flaw in a niche plugin: worth patching on a normal cadence rather than an emergency, and lower real-world priority than the 7.1 base score alone might suggest, because reflected XSS cannot be triggered without tricking a specific user. EPSS and any POC-confirmation data are missing from the input and should be verified before final prioritization.

An attacker crafts a malicious URL targeting a vulnerable parameter handled by the TableOn plugin and delivers it to a logged-in or anonymous site user via phishing, a comment, or a third-party page. When the victim opens the link, unsanitized input is reflected into the generated page and the injected script executes in the victim's browser in the site's context. No public exploit identified at time of analysis; only a Patchstack advisory reference is provided.