Stored XSS Vulnerability in WP Table Builder by WordPress
CVE-2026-2982

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
WP Table Builder – Drag & Drop Table Builder
Vendor
CVE Published:
12 November 2026

What is CVE-2026-2982?

The WP Table Builder plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the 'url' parameter, affecting versions up to and including 2.1.7. Authenticated users, such as contributors or higher, can exploit this vulnerability by injecting arbitrary web scripts into pages. When these pages are accessed, the scripts execute, potentially compromising user data integrity and security. Users with lower privileges may also exploit this by obtaining explicit permission from an administrator in the plugin settings.

Affected Version(s)

WP Table Builder – Drag & Drop Table Builder 0 <= 2.1.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3469639/wp-t...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lord willmore
.