Tablesome Table
Monthly
Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).
Blind SQL injection in the Essekia "Tablesome Table" WordPress plugin (versions up to and including 1.2.9) lets remote attackers inject malicious SQL into database queries, enabling inference-based extraction of database contents. The CVSS 3.1 score of 9.3 reflects unauthenticated network exploitability with a scope change (S:C), meaning the impact reaches the underlying WordPress database beyond the plugin itself. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthorized post creation and arbitrary post/page overwrite in the Tablesome Table WordPress plugin before version 1.1.31 due to missing authentication, capability, and nonce checks in an AJAX action. Unauthenticated attackers can create new published posts or overwrite any existing published content. Public exploit code exists, but no active exploitation has been confirmed; EPSS predicts very low exploitation probability (0.18%).