CVE-2025-2685

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2685", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-22T16:55:17.830Z", "datePublished": "2025-03-27T05:22:30.339Z", "dateUpdated": "2026-04-08T17:29:13.872Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:13.872Z"}, "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018table-name\u2019 parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "TablePress \u2013 Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e285849f-886e-49ba-bb43-8c67655fe239?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/views/class-all-tables-list-table.php#L242"}, {"url": "https://plugins.trac.wordpress.org/changeset/3261229/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "SavPhill"}], "timeline": [{"time": "2025-03-26T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-27T14:18:55.667591Z", "id": "CVE-2025-2685", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:38:55.202Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2685", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-27T14:18:55.667591Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-27T14:38:50.859Z"}}], "cna": {"title": "TablePress \u2013 Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "SavPhill"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.0.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-26T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e285849f-886e-49ba-bb43-8c67655fe239?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/views/class-all-tables-list-table.php#L242"}, {"url": "https://plugins.trac.wordpress.org/changeset/3261229/"}], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018table-name\u2019 parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:13.872Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2685", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:13.872Z", "dateReserved": "2025-03-22T16:55:17.830Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-27T05:22:30.339Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TablePress \u2013 Tables in WordPress made easy", "vendor": "tobiasbg", "versions": [{"lessThanOrEqual": "3.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tablepress:tablepress:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "8B8D30E8-D6C5-45B0-B8D1-E67D42D56E49", "versionEndExcluding": "3.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TablePress \u2013 Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018table-name\u2019 parameter in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento TablePress \u2013 Tables in WordPress made easy para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del par\u00e1metro 'table-name' en todas las versiones hasta la 3.0.4 incluida, debido a una depuraci\u00f3n de entrada y al escape de salida insuficiente. Esto permite a atacantes autenticados, con acceso de autor o superior, inyectar scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-2685", "lastModified": "2026-06-17T09:07:26.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2685", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-27T14:18:55.667591Z", "version": "2.0.3"}}]}, "published": "2025-03-27T06:15:29.550", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/tablepress/trunk/views/class-all-tables-list-table.php#L242"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/changeset/3261229/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e285849f-886e-49ba-bb43-8c67655fe239?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T23:26:43.565343+00:00", "value": {"mitigation_remediation": ["Update TablePress to the latest version (3.0.5 or newer) where sanitization and output escaping have been applied to the \u2018table\u2011name\u2019 field.", "If an immediate upgrade is not possible, disable or remove the ability for non\u2011administrator roles to edit table names by adjusting role capabilities within the plugin or WordPress.", "Employ a web application firewall or security plugin to detect and block malicious script content in the \u2018table\u2011name\u2019 parameter."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The flaw exists in all TablePress releases up to and including version 3.0.4. The product is a WordPress plugin named TablePress \u2013 Tables in WordPress made easy, provided by the author tobiasbg. Systems running WordPress with this plugin installed and an honest Author or higher role are susceptible. No specific WordPress core version is required beyond the plugin version.", "description_and_impact": "The TablePress plugin for WordPress stores table metadata in the database. An authenticated user with Author or higher privileges can edit a table\u2019s name through the \u2018table\u2011name\u2019 parameter. The plugin fails to sanitize or escape this input before rendering it into a table view, creating a stored cross\u2011site scripting flaw. An attacker who controls the table name can inject arbitrary JavaScript that will run in the browser context of any user who views the affected table, enabling session hijacking, cookie theft, or defacement. The vulnerability is limited to users who can edit tables and does not exploit public users.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity. The EPSS score of less than 1% suggests the likelihood of exploitation is low at the current time. The flaw is not listed in CISA\u2019s KEV catalog. Because the requires authenticated access, the vector is internal or trusted user. Once a trusted user injects malicious code, any other user who views the table will be impacted. The moderate score reflects the loss of confidentiality and integrity if session data is captured, but no direct remote code execution or data exfiltration outside the user session."}}}}, "created": "2026-04-20T23:30:16.124485+00:00", "updated": "2026-04-20T23:30:16.124497+00:00", "vendors": []}