Live › vulnerability › CVE-2026-115611
The TableOn posts-table-filterable WordPress-style plugin by PluginUs.Net fails to neutralize input when generating pages, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser session by tricking them into opening a crafted link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Any WordPress site with the TableOn (posts-table-filterable) plugin by RealMag777/PluginUs.Net active at version 1.0.7 or older. An attacker needs a visitor, including an admin, to open a crafted link, so sites with logged-in editors or admins are the worst case. The exact reflected parameter is not published. Sites without the plugin, or with it deactivated, can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| posts-table-filterable | wordpress | <= 1.0.7 | – |
1.0.7Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-115611")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.