---
id: "CVE-2026-2982"
page: "https://infrastack.ai/live/CVE-2026-2982"
kind: "vulnerability"
aliases: ["CVE-2026-2982"]
title: "WP Table Builder WordPress plugin: stored XSS via url parameter"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "wordpress", "wp-table-builder"]
not_affected_if: ["no-untrusted-contributors", "plugin-not-installed", "roles-not-enabled"]
published_at: "2026-11-12T12:18:24+00:00"
first_seen_at: "2026-11-12T12:38:19+00:00"
updated_at: "2026-11-12T12:40:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2982", "first_seen_at": "2026-11-12T12:38:19+00:00"}]
exploit_sources: []
---

# WP Table Builder WordPress plugin: stored XSS via url parameter

Link for people: https://infrastack.ai/live/CVE-2026-2982 (this .md is for agents)

The WP Table Builder plugin for WordPress does not sanitize the 'url' parameter when saving table data, so script stored in it runs in pages. An authenticated contributor-level user can make visitors' browsers run attacker-supplied scripts whenever they open an affected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the WP Table Builder plugin in the WordPress admin Plugins screen; versions up to and including `2.1.7` are affected.
- Review who holds Contributor, Author or Editor roles on the site, since they can create the injected content.

## Timeline

- 2026-11-12T12:38:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2982

## From the sources

The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_