CVE-2026-3513

The TableOn WordPress Posts Table Filterable plugin versions up to 1.0.4.4 contains a Stored Cross-Site Scripting vulnerability in the 'tableon_button' shortcode due to insufficient input sanitization and output escaping. Attackers can inject malicious scripts through unescaped shortcode attributes including 'class', 'help_link', 'popup_title', and 'help_title' that will execute when users access affected pages. The vulnerability carries a CVSS 3.1 score of 6.4 (MEDIUM severity) with a network-based attack vector, low complexity, and requirement for authenticated user privileges at Contributor level or above. The attack has cross-site scope with limited confidentiality and integrity impact, making it a moderate concern for multi-user WordPress installations. There is currently no evidence of active exploitation in the wild, no public exploit code availability, and the vulnerability does not appear on the Known Exploited Vulnerabilities catalog. Community attention remains low based on EPSS metrics, though the FAUCET risk score of 44.0 indicates organizations should prioritize updates when the plugin maintainers release a patched version.