Stored Cross-Site Scripting Vulnerability in Posts Table Plugin for WordPress
CVE-2026-118189

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Posts Table With Search & Sort
Vendor
CVE Published:
6 November 2026

What is CVE-2026-118189?

The Posts Table with Search & Sort plugin for WordPress contains a vulnerability that enables Stored Cross-Site Scripting (XSS) through the 'date_format' parameter. This issue affects all versions up to and including 1.4.14, stemming from inadequate input sanitization and output escaping. Authenticated attackers with contributor-level access can inject malicious scripts into the plugin, leading to the execution of those scripts when the affected pages are accessed by users. This occurs because certain malicious HTML tags are reconstructed only at render time, which allows contributors to exploit this vulnerability even without unfiltered HTML capabilities.

Affected Version(s)

Posts Table with Search & Sort 0 <= 1.4.14

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/posts-data-tab...
https://plugins.trac.wordpress.org/browser/posts-data-tab...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.