Stored XSS Vulnerability in TablePress Plugin for WordPress

CVE-2025-9500

What is CVE-2025-9500?

The TablePress plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability that arises from inadequate input sanitization and output escaping. This issue allows authenticated users with Contributor-level access and higher to insert arbitrary scripts into web pages. When other users access these pages, the injected scripts execute, potentially compromising user data and security. It is crucial for website administrators to update to the latest version of the plugin and implement security best practices to mitigate this threat.

References