---
id: "CVE-2026-115611"
kind: "vulnerability"
aliases: ["CVE-2026-115611"]
title: "TableOn posts-table-filterable plugin: reflected XSS through version 1.0.7"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "posts-table-filterable", "fixed": [], "affected": "<= 1.0.7", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "reflected-xss", "tableon", "web-plugin", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-10-29T11:17:30+00:00"
first_seen_at: "2026-10-29T11:24:28+00:00"
updated_at: "2026-10-29T11:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-115611", "first_seen_at": "2026-10-29T11:24:28+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T11:26:40+00:00"}]
---

# TableOn posts-table-filterable plugin: reflected XSS through version 1.0.7

The TableOn posts-table-filterable WordPress-style plugin by PluginUs.Net fails to neutralize input when generating pages, enabling reflected cross-site scripting. An attacker can run script in a visitor's browser session by tricking them into opening a crafted link.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:posts-table-filterable affected <= 1.0.7 fixed ?

## How to check

- WordPress admin > Plugins: look for 'TableOn – WordPress Posts Table Filterable' and its version.
- Or with WP-CLI: wp plugin get posts-table-filterable --field=version
- Version 1.0.7 or older is in the affected range.

## Fix

No fixed version known: 1.0.7 is the latest release on wordpress.org and is the last affected version. Deactivate or remove the plugin until the author ships a newer release.

## Timeline

- 2026-10-29T11:24:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-115611
- 2026-10-29T11:26:40+00:00 analyst — NVD only; no Patchstack page for this CVE found. wordpress.org lists 1.0.7 as latest (changelog 1.0.7 mentions a security fix, probably another issue), so no fix after 1.0.7 is visible; parameter unknown. Nothing verified: the vendor page does not describe this CVE. Sibling TableOn XSS CVEs exist (CVE-2025-69316 fixed in 1.0.4.3).

## Documents

- [advisory] TableOn – WordPress Posts Table Filterable (wordpress.org, changelog to 1.0.7) https://wordpress.org/plugins/posts-table-filterable/
- [mentions] Patchstack: TableOn vulnerability history (latest 1.0.7) https://patchstack.com/database/wordpress/plugin/posts-table-filterable/vulnerabilities

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net TableOn posts-table-filterable allows Reflected XSS.This issue affects TableOn: from n/a through 1.0.7.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_