EUVD-2026-14183
GHSA-gwmc-j777-wj8p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Sheets2Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titles' shortcode attribute in the [sheets2table-render-table] shortcode in all versions up to and including 0.4.1. This is due to insufficient input sanitization and output escaping. Specifically, the 'titles' attribute value from the shortcode is passed through S2T_Functions::trim_array_values() (which only trims whitespace) and then echoed directly into HTML via echo $header inside a <th> tag in the display_table_header() function without any escaping such as esc_html(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
The Sheets2Table WordPress plugin versions up to 0.4.1 contain a Stored Cross-Site Scripting (XSS) vulnerability in the [sheets2table-render-table] shortcode's 'titles' attribute, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript that executes for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the display_table_header() function, where user-supplied shortcode attributes are echoed directly into HTML without proper escaping mechanisms such as esc_html().
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects the Sheets2Table plugin (CPE: cpe:2.3:a:tonyh-1:sheets2table:*:*:*:*:*:*:*:*). The root cause lies in the plugin's shortcode processing pipeline, specifically in the core/sheets2table-shortcodes.php file where the 'titles' shortcode attribute is extracted and passed to the S2T_Functions::trim_array_values() function. This trimming function only removes whitespace and provides no sanitization. The unsanitized value is then directly echoed into HTML table header (<th>) tags via the display_table_header() function in core/class-sheets2table-tables.php at line 122, bypassing WordPress's standard output escaping functions. This represents a failure to apply defense-in-depth principles whereby both input validation and output encoding should be employed to prevent XSS injection in a WordPress context.
RemediationAI
Users of the Sheets2Table plugin should update to the latest patched version as soon as it becomes available from the plugin developer, as official patch status was not confirmed in available intelligence. The primary remediation is to upgrade to a version released after 0.4.1 that includes proper output escaping using WordPress functions such as esc_html() or esc_attr() for the 'titles' shortcode attribute before echoing values into HTML context. Until a patch is available, administrators should restrict the [sheets2table-render-table] shortcode usage to trusted content creators only by limiting Contributor-level and above access to essential personnel, and consider disabling the plugin entirely if it is not actively used. Code-level mitigation involves manually patching the display_table_header() function in core/class-sheets2table-tables.php to wrap the $header variable with esc_html() before output, ensuring that any HTML special characters in user input are properly encoded. Monitor the WordPress plugins repository (https://plugins.trac.wordpress.org/browser/sheets2table/) for patch availability and check Wordfence threat intelligence regularly for confirmed remediation guidance.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today