{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9500", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-26T19:06:27.544Z", "datePublished": "2025-08-30T04:25:06.121Z", "dateUpdated": "2026-04-08T16:43:38.201Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:38.201Z"}, "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018shortcode_debug\u2019 parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "TablePress <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L635"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L903"}, {"url": "https://wordpress.org/plugins/tablepress/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3352096/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-08-27T20:24:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-08-29T16:24:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-02T14:24:27.992443Z", "id": "CVE-2025-9500", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T14:46:54.646Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9500", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-02T14:24:27.992443Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-02T14:46:52.180Z"}}], "cna": {"title": "TablePress <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_debug Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "tobiasbg", "product": "TablePress \u2013 Tables in WordPress made easy", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-27T20:24:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-08-29T16:24:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L635"}, {"url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L903"}, {"url": "https://wordpress.org/plugins/tablepress/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3352096/"}], "descriptions": [{"lang": "en", "value": "The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018shortcode_debug\u2019 parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:38.201Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9500", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:38.201Z", "dateReserved": "2025-08-26T19:06:27.544Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-30T04:25:06.121Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018shortcode_debug\u2019 parameter in all versions up to, and including, 3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-9500", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-08-30T05:15:48.430", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L635"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tablepress/tags/3.1.3/controllers/controller-frontend.php#L903"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3352096/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/tablepress/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b24ae23-d055-4740-bd86-126d503fce1b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:23:23.613624+00:00", "value": {"mitigation_remediation": ["Upgrade TablePress to the latest version that removes the vulnerability (e.g., 3.3 or later).", "If an upgrade is not immediately possible, disable the shortcode_debug feature or remove any custom shortcodes that include it from existing tables.", "Apply additional security controls such as a Content Security Policy that blocks inline scripts and limits external script sources to prevent execution of injected code."], "summary": {"action": "Update Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The plugin known as TablePress, made popular by the vendor tobiasbg, is affected in all releases up through version\u202f3.2. WordPress sites running any of those versions and granting Contributor or higher permissions are vulnerable. Users should verify the plugin version and update accordingly.", "description_and_impact": "The vulnerability arises from insufficient sanitization of the \u2018shortcode_debug\u2019 parameter in the TablePress plugin. An authenticated attacker with Contributor-level access can embed malicious scripts that are stored in the plugin\u2019s database. When other site users load the affected page, the injected scripts execute in their browsers, potentially compromising session data, defacing content, or facilitating phishing attacks. This flaw aligns with CWE\u201179: Injection: Improper Neutralization of Input During Web Page Generation.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than\u202f1\u202f% signals that the vulnerability is not widely exploited in the public space. It is not listed in the CISA KEV catalog, suggesting no known active exploitation reports. The attack vector requires authenticated access with at least Contributor privileges, which are often granted to content authors. Once exploited, the embedded script runs in the context of any visitor to the affected page, expanding the potential impact across the site\u2019s user base."}}}}, "created": "2025-09-02T15:23:31.128006+00:00", "updated": "2026-04-22T14:30:18.959665+00:00", "vendors": ["tablepress", "tablepress$PRODUCT$tablepress", "wordpress", "wordpress$PRODUCT$wordpress"]}