CVE-2025-5143
BaseFortify
Publication date: 2025-06-21
Last updated on: 2025-07-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pluginus | tableon_-_wordpress_posts_table_filterable | to 1.0.4.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-5143 is a Stored Cross-Site Scripting (XSS) vulnerability in the TableOn – WordPress Posts Table Filterable plugin. It occurs due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcode 'tableon_popup_iframe_button'. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute whenever a user accesses the injected page. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows authenticated users with contributor-level access or above to inject malicious scripts into pages via the plugin's shortcode. These scripts execute in the context of other users viewing the affected pages, potentially leading to theft of user credentials, session hijacking, defacement, or other malicious actions within the WordPress site. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress site is running the TableOn – WordPress Posts Table Filterable plugin at version 1.0.4.1 or earlier, as these versions are vulnerable. Detection can involve verifying the plugin version via the WordPress admin dashboard or by inspecting the plugin files. Additionally, monitoring for suspicious stored cross-site scripting payloads in pages using the tableon_popup_iframe_button shortcode may help identify exploitation attempts. There are no specific commands provided in the resources for detection. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the TableOn – WordPress Posts Table Filterable plugin to version 1.0.4.2 or later, which includes security fixes that properly sanitize user inputs to prevent stored cross-site scripting. Additionally, ensure that the WordPress installation and PHP version meet the updated requirements (PHP 7.4 or higher). Limiting contributor-level access to trusted users can also reduce risk until the update is applied. [1, 2]