CVE-2025-12324

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12324", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-27T10:15:14.904Z", "datePublished": "2025-11-04T02:26:55.497Z", "dateUpdated": "2026-04-08T16:51:33.261Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:33.261Z"}, "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "TablePress \u2013 Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbd8cac-9e4b-4353-9c62-9cabb60b927c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.2.4/controllers/controller-frontend.php#L605"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-15T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-27T12:43:08.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-03T14:02:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T14:49:20.958194Z", "id": "CVE-2025-12324", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:49:27.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12324", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T14:49:20.958194Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T14:49:23.915Z"}}], "cna": {"title": "TablePress \u2013 Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-15T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-27T12:43:08.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-03T14:02:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbd8cac-9e4b-4353-9c62-9cabb60b927c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.2.4/controllers/controller-frontend.php#L605"}], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:51:33.261Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12324", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:51:33.261Z", "dateReserved": "2025-10-27T10:15:14.904Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T02:26:55.497Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TablePress \u2013 Tables in WordPress made easy", "vendor": "tobiasbg", "versions": [{"lessThanOrEqual": "3.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `table` shortcode attributes in all versions up to, and including, 3.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin TablePress - Tables in WordPress made easy para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de los atributos del shortcode 'table' del plugin en todas las versiones hasta la 3.2.3, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos proporcionados por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador o superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-12324", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12324", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T14:49:20.958194Z", "version": "2.0.3"}}]}, "published": "2025-11-04T03:15:49.667", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.2.4/controllers/controller-frontend.php#L605"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4dbd8cac-9e4b-4353-9c62-9cabb60b927c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:33:48.397228+00:00", "value": {"mitigation_remediation": ["Upgrade the TablePress plugin to a patched version newer than 3.2.3 which implements proper input sanitization and output escaping for all shortcode attributes.", "If an immediate upgrade is not feasible, restrict contributor and other non\u2011administrator roles from editing tables or from adding shortcodes that accept user\u2011supplied attributes, using WordPress role editor or a capabilities plugin to revoke the \u2018edit_table\u2019 right.", "Apply an additional layer of protection by enabling a Content Security Policy that disallows inline JavaScript or by using a security plugin such as Wordfence to block execution of scripts originating from table content."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via shortcode attributes"}, "threat_synthesis": {"affected_systems": "All installations of the tobiasbg TablePress \u2013 Tables in WordPress made easy plugin up to and including version 3.2.4 (the official advisories note the issue exists through 3.2.3), running on any WordPress site that permits contributors to modify tables.", "description_and_impact": "The TablePress plugin allows users to create tables in WordPress by inserting a shortcode that accepts attributes. When these attributes are not properly sanitized or escaped, an attacker with contributor level or higher can store arbitrary JavaScript code in a table. Once any user views a page that includes the affected table, the injected script runs in the victim\u2019s browser, enabling theft of credentials, session hijacking, or defacement. This vulnerability is a classic stored XSS flaw (CWE\u201179).", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must already possess authenticated contributor or higher access to inject malicious code, making the attack vector internal. If the role permissions are lax, the breadth of impact could extend throughout the site. Nevertheless, the combination of moderate CVSS and low EPSS suggests a lower but still notable risk that should be remediated promptly."}}}}, "created": "2025-11-04T16:33:21.924433+00:00", "updated": "2026-04-22T12:45:17.020884+00:00", "vendors": ["tablepress", "tablepress$PRODUCT$tablepress", "wordpress", "wordpress$PRODUCT$wordpress"]}