{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11817", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-15T17:05:26.369Z", "datePublished": "2025-10-22T08:27:10.519Z", "dateUpdated": "2026-04-08T17:27:39.439Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:39.439Z"}, "affected": [{"vendor": "garyhukkeri", "product": "Simple Tableau Viz", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Simple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=cve"}, {"url": "https://wordpress.org/plugins/simple-tableau-viz/"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-tableau-viz/tags/2.0/simple-tableau-viz.php#L24"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "timeline": [{"time": "2025-10-21T20:24:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T14:16:55.947776Z", "id": "CVE-2025-11817", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T14:17:10.513Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11817", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T14:16:55.947776Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T14:17:03.948Z"}}], "cna": {"title": "Simple Tableau Viz <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "zakaria"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "garyhukkeri", "product": "Simple Tableau Viz", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-21T20:24:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=cve"}, {"url": "https://wordpress.org/plugins/simple-tableau-viz/"}, {"url": "https://plugins.trac.wordpress.org/browser/simple-tableau-viz/tags/2.0/simple-tableau-viz.php#L24"}], "descriptions": [{"lang": "en", "value": "The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:39.439Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11817", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:39.439Z", "dateReserved": "2025-10-15T17:05:26.369Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-22T08:27:10.519Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Simple Tableau Viz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableau' shortcode in all versions up to, and including, 2.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-11817", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-10-22T09:15:33.403", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/simple-tableau-viz/tags/2.0/simple-tableau-viz.php#L24"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/simple-tableau-viz/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/dbd33d03-81ba-468e-9e25-fe9f13914dbd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:09:16.772078+00:00", "value": {"mitigation_remediation": ["Upgrade the Simple Tableau Viz plugin to the latest release (any version newer than 2.0).", "If an update is not immediately possible, remove contributor-level access from all users or prohibit contributors from adding content that can render the \u2018tableau\u2019 shortcode, and consider disabling the plugin until it can be updated.", "Keep your WordPress installation and all other plugins up to date, and enforce the principle of least privilege by restricting editing rights to trusted users only."], "summary": {"action": "Patch Update", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Simple Tableau Viz plugin for WordPress, authored by Gary Hukkeri, in all releases up to and including version\u00a02.0. No other vendors or products are impacted.", "description_and_impact": "The Simple Tableau Viz WordPress plugin contains a stored cross\u2011site scripting flaw in the \u2018tableau\u2019 shortcode that permits authenticated users with contributor-level access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes. When a user accesses a page containing the malicious shortcode, the injected script runs in the victim\u2019s browser, enabling defacement, credential theft, or malicious redirects. This flaw arises from insufficient input sanitization and output escaping within the plugin code.", "risk_and_exploitability": "The CVSS score of\u00a06.4 indicates a medium impact, while the EPSS score of less than\u00a01% shows a very low probability of exploitation. The flaw is limited to authenticated contributors, meaning an attacker must first gain at least contributor rights to inject the malicious shortcode. Once injected, the script executes for every visitor to the affected page. The vulnerability is not listed in the CISA KEV catalog, reducing the likelihood of widespread active exploitation."}}}}, "created": "2025-10-23T10:08:02.287186+00:00", "updated": "2026-04-21T02:15:06.528841+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}