DOM-Based Stored Cross-Site Scripting in TablePress Plugin from WordPress

CVE-2025-5096

What is CVE-2025-5096?

The TablePress plugin for WordPress is susceptible to DOM-Based Stored Cross-Site Scripting vulnerabilities. This arises from the insufficient sanitization of inputs and failure to escape outputs for various data attributes, including 'data-caption', 'data-s-content-padding', 'data-s-title', and 'data-footer'. Authenticated attackers with Contributor-level access or higher can exploit this issue to inject and execute arbitrary web scripts on pages, affecting all users who access the compromised content.

References