CVE-2026-3513 realmag777 CVE debrief

Who should care

Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability affects users of the TableOn – WordPress Posts Table Filterable plugin for WordPress, particularly those with Contributor-level access and above.

Technical summary

The do_shortcode_button() function extracts shortcode attributes without sanitization and passes them to TABLEON_HELPER::draw_html_item(), which concatenates attribute values into HTML using single quotes without escaping. This allows for Stored Cross-Site Scripting attacks. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Medium priority due to CVSS score of 6.4 and potential for authenticated attackers to inject scripts.

Recommended defensive actions

• Update to a patched version of the TableOn – WordPress Posts Table Filterable plugin
• Implement input validation and output encoding for user-supplied shortcode attributes
• Monitor for suspicious activity and injected scripts
• Restrict access to shortcode functionality to trusted users
• Regularly review and update plugins to ensure latest security patches
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

CVE-2026-3513 details from NVD and Wordfence threat intelligence. Limited information available on affected scope and vendor remediation efforts. The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'.

Official resources