PT-2026-52433 · WordPress · Tablepress

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-56051

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions TablePress versions prior to 3.3.2

Description An unauthenticated cross-site scripting (XSS) flaw allows malicious script content to be injected via user-controlled input rendered by the plugin. The issue stems from improper input validation and output escaping, which enables stored or reflected script execution in plugin-generated pages. A remote attacker can submit crafted payloads that execute client-side code in the browser of site visitors or administrators, potentially leading to session hijacking, credential theft, admin action forgery, and full site takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56051

Affected Products

Tablepress

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56051 · Security Note
• https://patchstack.com/database/wordpress/plugin/tablepress/vulnerability/wordpress-tablepress-plugin-3-3-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://twitter.com/UpwindMDR/status/2070200454760292812 · Twitter Post