{"id":"CVE-2026-115611","kind":"vulnerability","aliases":["CVE-2026-115611"],"related":[],"title":"TableOn posts-table-filterable plugin: reflected XSS through version 1.0.7","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.","summary":"The TableOn posts-table-filterable WordPress-style plugin by PluginUs.Net fails to neutralize input when generating pages, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser session by tricking them into opening a crafted link.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"posts-table-filterable","fixed":[],"affected":"<= 1.0.7","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","reflected-xss","tableon","web-plugin","wordpress","wordpress-plugin"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: look for 'TableOn – WordPress Posts Table Filterable' and its version.\n- Or with WP-CLI: wp plugin get posts-table-filterable --field=version\n- Version 1.0.7 or older is in the affected range.","fix":"No fixed version known: 1.0.7 is the latest release on wordpress.org and is the last affected version. Deactivate or remove the plugin until the author ships a newer release.","status":"open","published_at":"2026-10-29T11:17:30+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","triaged_at":"2026-10-29T11:25:33+00:00","updated_at":"2026-10-29T11:26:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T11:25:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"TableOn posts-table-filterable plugin: reflected XSS through version 1.0.7","impact":"medium","summary":"The TableOn posts-table-filterable WordPress-style plugin by PluginUs.Net fails to neutralize input when generating pages, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser session by tricking them into opening a crafted link.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","web-plugin","tableon"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker script runs in victims' browser sessions on the site","analyst_note":"Find the vendor or advisory page for TableOn posts-table-filterable to confirm the platform, the affected parameter and whether a fixed version exists after 1.0.7.","how_to_check":"- Check whether the TableOn posts-table-filterable plugin is installed and its version, from the plugin list or the plugin's main file header.\n- Confirm the installed version is 1.0.7 or older, the range the source lists as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the TableOn posts-table-filterable plugin at version 1.0.7 or older, where user-supplied input is reflected into pages. The sources do not name a host platform or give the exact reflected parameter, so exposure beyond the plugin's presence is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4122,"output_tokens":569,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor or advisory page for TableOn posts-table-filterable to confirm the platform, the affected parameter and whether a fixed version exists after 1.0.7.","search":"'-115611':14A,17A '-2026':13A,16A '1.0.7':11A,107C 'affect':102C 'allow':98C 'attack':60B 'browser':68B 'craft':76B 'cross':56B,87C 'cross-sit':55B,86C 'cve':12A,15A 'enabl':53B 'fail':46B 'filter':5A,39B,97C 'filterable':21A 'generat':51B,85C 'improp':78C 'input':49B,81C 'issu':101C 'link':77B 'n/a':105C 'neutral':48B,79C 'open':74B 'packag':22B 'page':52B,84C 'plugin':6A,29B,33B,43B 'pluginus.net':45B,92C 'post':3A,37B,95C 'posts':19A 'posts-table-filter':2A,36B,94C 'posts-table-filterable':18A 'reflect':7A,24B,54B,99C 'reflected-xss':23B 'run':62B 'script':58B,63B,89C 'session':69B 'site':57B,88C 'style':42B 'tabl':4A,38B,96C 'table':20A 'tableon':1A,26B,35B,93C,103C 'trick':71B 'version':10A 'visitor':66B 'vulner':90C 'web':28B,83C 'web-plugin':27B 'wordpress':30B,32B,41B 'wordpress-plugin':31B 'wordpress-styl':40B 'xss':8A,25B 'xss.this':100C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site with the TableOn (posts-table-filterable) plugin by RealMag777/PluginUs.Net active at version 1.0.7 or older. An attacker needs a visitor, including an admin, to open a crafted link, so sites with logged-in editors or admins are the worst case. The exact reflected parameter is not published. Sites without the plugin, or with it deactivated, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T11:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115611","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115611","severity":null,"published_at":"2026-10-29T11:17:30+00:00","modified_at":"2026-10-29T11:17:30+00:00","first_seen_at":"2026-10-29T11:24:28+00:00","fetched_at":"2026-10-29T11:24:28+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-115611:1016","url":null,"severity":null,"published_at":"2026-10-29T11:26:40+00:00","modified_at":"2026-10-29T11:26:40+00:00","first_seen_at":"2026-10-29T11:26:40+00:00","fetched_at":"2026-10-29T11:26:40+00:00","note":"NVD only; no Patchstack page for this CVE found. wordpress.org lists 1.0.7 as latest (changelog 1.0.7 mentions a security fix, probably another issue), so no fix after 1.0.7 is visible; parameter unknown. Nothing verified: the vendor page does not describe this CVE. Sibling TableOn XSS CVEs exist (CVE-2025-69316 fixed in 1.0.4.3)."}],"documents":[{"id":16107,"url":"https://wordpress.org/plugins/posts-table-filterable/","title":"TableOn – WordPress Posts Table Filterable (wordpress.org, changelog to 1.0.7)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":16108,"url":"https://patchstack.com/database/wordpress/plugin/posts-table-filterable/vulnerabilities","title":"Patchstack: TableOn vulnerability history (latest 1.0.7)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}