Stored Cross-Site Scripting Vulnerability in BuddyHolis TableSearch Plugin for WordPress
CVE-2026-15301

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Buddyholis Tablesearch
Vendor
CVE Published:
10 July 2026

What is CVE-2026-15301?

The BuddyHolis TableSearch plugin for WordPress is susceptible to a stored cross-site scripting issue due to deficiencies in input sanitization and output escaping in the 'placeholder' parameter. This vulnerability allows authenticated attackers, specifically those with Contributor-level permissions and higher, to inject arbitrary web scripts. The injected scripts will execute on user pages when accessed, potentially compromising user data and security.

Affected Version(s)

BuddyHolis TableSearch 0 <= 1.1.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/tablesearch/ta...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zakaria
.