CVE-2025-5143

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5143", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-23T22:00:03.359Z", "datePublished": "2025-06-21T06:42:48.687Z", "dateUpdated": "2026-04-08T16:49:23.642Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:23.642Z"}, "affected": [{"vendor": "realmag777", "product": "TableOn \u2013 WordPress Posts Table Filterable", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TableOn \u2013 WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "TableOn \u2013 WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/447d3aa6-2ed3-4da3-b9e8-fc7792c8c29a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/index.php#L1630"}, {"url": "https://wordpress.org/plugins/posts-table-filterable/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3315337/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-06-13T23:21:51.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-06-20T18:15:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-23T20:47:09.257228Z", "id": "CVE-2025-5143", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T20:47:20.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-5143", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-23T20:47:09.257228Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-23T20:47:15.607Z"}}], "cna": {"title": "TableOn \u2013 WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "realmag777", "product": "TableOn \u2013 WordPress Posts Table Filterable", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-06-13T23:21:51.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-06-20T18:15:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/447d3aa6-2ed3-4da3-b9e8-fc7792c8c29a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/index.php#L1630"}, {"url": "https://wordpress.org/plugins/posts-table-filterable/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3315337/"}], "descriptions": [{"lang": "en", "value": "The TableOn \u2013 WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:23.642Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5143", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:23.642Z", "dateReserved": "2025-05-23T22:00:03.359Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-06-21T06:42:48.687Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "TableOn \u2013 WordPress Posts Table Filterable", "vendor": "realmag777", "versions": [{"lessThanOrEqual": "1.0.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluginus:tableon_-_wordpress_posts_table_filterable:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "0E7C09E4-76DE-40D6-879C-30264FE10F6B", "versionEndExcluding": "1.0.4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The TableOn \u2013 WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tableon_popup_iframe_button shortcode in all versions up to, and including, 1.0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento TableOn \u2013 WordPress Posts Table Filterable para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del shortcode tableon_popup_iframe_button en todas las versiones hasta la 1.0.4.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-5143", "lastModified": "2026-06-17T09:47:19.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5143", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-23T20:47:09.257228Z", "version": "2.0.3"}}]}, "published": "2025-06-21T07:15:22.110", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://plugins.trac.wordpress.org/browser/posts-table-filterable/trunk/index.php#L1630"}, {"source": "security@wordfence.com", "tags": ["Patch"], "url": "https://plugins.trac.wordpress.org/changeset/3315337/"}, {"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/posts-table-filterable/#developers"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/447d3aa6-2ed3-4da3-b9e8-fc7792c8c29a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T20:07:38.735664+00:00", "value": {"mitigation_remediation": ["Upgrade the TableOn \u2013 WordPress Posts Table Filterable plugin to the latest available version that addresses the XSS issue.", "Remove or sanitize any existing instances of the tableon_popup_iframe_button shortcode that include user\u2011supplied attributes; replace them with safe content or delete the malicious payloads.", "Limit contributor\u2011level access to trusted users and enforce a policy that contributors cannot add arbitrary shortcodes until the plugin is patched; alternatively, disable the shortcode via a plugin setting or custom code."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting (XSS) via unsanitized shortcode attributes"}, "threat_synthesis": {"affected_systems": "The affected product is the TableOn \u2013 WordPress Posts Table Filterable plugin developed by realmag777. All released versions up to and including 1.0.4.1 are vulnerable, as indicated by the plugin's change log and source code. The plugin is a WordPress plugin and is deployed on any WordPress installation where it has been activated. No other WordPress core components are directly impacted.", "description_and_impact": "The vulnerability lies in insufficient input sanitization and output escaping on attributes of the tableon_popup_iframe_button shortcode in the TableOn \u2013 WordPress Posts Table Filterable plugin. The plugin allows any authenticated user with contributor privileges or higher to inject arbitrary scripts into the shortcode. When a user browses a page containing that shortcode, the stored malicious script executes with the context of the viewing user. This can lead to theft of session cookies, defacement, or execution of other malicious actions. This flaw is classified as a Stored Cross\u2011Site Scripting (CWE\u201179).", "risk_and_exploitability": "The CVSS score is 6.4, indicating a medium severity. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers need authenticated access at least at the contributor role, so they must either compromise a user account or exploit a credential or social engineering scenario. Once the malicious shortcode is persisted, any user viewing the affected page will execute the injected script, potentially escalating the impact within the site."}}}}, "created": "2026-04-21T20:15:44.574750+00:00", "updated": "2026-04-21T20:15:44.574765+00:00", "vendors": []}