TablePress up to and including 3.2 renders shortcode render options through var_export() without escaping when the shortcode_debug attribute is set. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript through a table shortcode attribute, which then executes for any logged-in user who views the page.
This vulnerability affects the following application versions:
- TablePress 2.0.4
- TablePress 2.1.7
- TablePress 2.1.8
- TablePress 2.2
- TablePress 2.2.1
- TablePress 2.2.2
- TablePress 2.2.3
- TablePress 2.2.4
- TablePress 2.2.5
- TablePress 2.3
- TablePress 2.3.1
- TablePress 2.3.2
- TablePress 2.4
- TablePress 2.4.1
- TablePress 2.4.2
- TablePress 2.4.3
- TablePress 2.4.4
- TablePress 3.0
- TablePress 3.0.1
- TablePress 3.0.2
- TablePress 3.0.3
- TablePress 3.0.4
- TablePress 3.1
- TablePress 3.1.1
- TablePress 3.1.2
- TablePress 3.1.3
- TablePress 3.2