PatchSiren cyber security CVE debrief
CVE-2026-3513 realmag777 CVE debrief
The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Vendor
- realmag777
- Product
- TableOn – WordPress Posts Table Filterable
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-08
- Original CVE updated
- 2026-07-24
- Advisory published
- 2026-04-08
- Advisory updated
- 2026-07-24
Who should care
Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability affects users of the TableOn – WordPress Posts Table Filterable plugin for WordPress, particularly those with Contributor-level access and above.
Technical summary
The do_shortcode_button() function extracts shortcode attributes without sanitization and passes them to TABLEON_HELPER::draw_html_item(), which concatenates attribute values into HTML using single quotes without escaping. This allows for Stored Cross-Site Scripting attacks. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Defensive priority
Medium priority due to CVSS score of 6.4 and potential for authenticated attackers to inject scripts.
Recommended defensive actions
- Update to a patched version of the TableOn – WordPress Posts Table Filterable plugin
- Implement input validation and output encoding for user-supplied shortcode attributes
- Monitor for suspicious activity and injected scripts
- Restrict access to shortcode functionality to trusted users
- Regularly review and update plugins to ensure latest security patches
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
CVE-2026-3513 details from NVD and Wordfence threat intelligence. Limited information available on affected scope and vendor remediation efforts. The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-3513 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-3513
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-3513 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3513
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/index.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/index.php
-
Source reference
Unverified legacy reference
URL: https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/lib/helper.php
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.