Wp Table Builder
Monthly
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder allows Reflected XSS.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder - WordPress Table Plugin allows Stored XSS.4.15. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Table Builder - WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button element in all versions up to, and including, 1.4.14 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken Access Control in WP Table Builder WordPress plugin versions 2.2.0 and earlier permits authenticated Contributor-level users to invoke restricted plugin functionality beyond their assigned role scope, resulting in unauthorized integrity impact against site content. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate whether the requesting user holds sufficient privileges before executing sensitive operations. No public exploit has been identified at time of analysis, and KEV status is not confirmed, placing this in a managed-patching priority tier rather than an emergency response category.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder allows Reflected XSS.0.4. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP Table Builder WordPress plugin through 1.5.0 does not sanitise and escape some of its Table data, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder - WordPress Table Plugin allows Stored XSS.4.15. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The WP Table Builder - WordPress Table Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the button element in all versions up to, and including, 1.4.14 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.