Stored Cross-Site Scripting in TableOn Plugin for WordPress by DataGuard

CVE-2026-3513

What is CVE-2026-3513?

The TableOn – WordPress Posts Table Filterable plugin contains a vulnerability that allows authenticated users with Contributor-level access and higher to execute arbitrary web scripts. This occurs via the 'tableon_button' shortcode attributes, which lack proper input sanitization and output escaping. Attackers can exploit this weakness to inject malicious scripts into WordPress pages. When these manipulated pages are accessed, the injected scripts will run in the context of the user’s session, potentially leading to severe security risks. The issue stems from insufficient handling of user-supplied data within the do_shortcode_button() function, which incorrectly processes shortcode attributes, allowing attackers to craft harmful content.

References