PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-3513 realmag777 CVE debrief

The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor
realmag777
Product
TableOn – WordPress Posts Table Filterable
CVSS
MEDIUM 6.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability affects users of the TableOn – WordPress Posts Table Filterable plugin for WordPress, particularly those with Contributor-level access and above.

Technical summary

The do_shortcode_button() function extracts shortcode attributes without sanitization and passes them to TABLEON_HELPER::draw_html_item(), which concatenates attribute values into HTML using single quotes without escaping. This allows for Stored Cross-Site Scripting attacks. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Medium priority due to CVSS score of 6.4 and potential for authenticated attackers to inject scripts.

Recommended defensive actions

  • Update to a patched version of the TableOn – WordPress Posts Table Filterable plugin
  • Implement input validation and output encoding for user-supplied shortcode attributes
  • Monitor for suspicious activity and injected scripts
  • Restrict access to shortcode functionality to trusted users
  • Regularly review and update plugins to ensure latest security patches
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

CVE-2026-3513 details from NVD and Wordfence threat intelligence. Limited information available on affected scope and vendor remediation efforts. The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' shortcode in all versions up to and including 1.0.4.4. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'class', 'help_link', 'popup_title', and 'help_title'.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-3513 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-3513

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-3513 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-3513

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.