TablePress

A table’s datetime format string was interpolated straight into an inline JavaScript command without escaping, so a value containing a quote could break out and execute script in the browser of anyone viewing the table. The format string is now passed through wp_json_encode with JSON_HEX_TAG, which escapes quotes and angle brackets.

This vulnerability affects the following application versions:

• TablePress 3.0
• TablePress 3.0.1
• TablePress 3.0.2
• TablePress 3.0.3
• TablePress 3.0.4
• TablePress 3.1
• TablePress 3.1.1
• TablePress 3.1.2
• TablePress 3.1.3
• TablePress 3.2
• TablePress 3.2.1
• TablePress 3.2.2
• TablePress 3.2.3
• TablePress 3.2.4

TablePress up to and including 3.2 renders shortcode render options through var_export() without escaping when the shortcode_debug attribute is set. An authenticated attacker with Contributor-level access or above can inject arbitrary JavaScript through a table shortcode attribute, which then executes for any logged-in user who views the page.

This vulnerability affects the following application versions:

• TablePress 2.0.4
• TablePress 2.1.7
• TablePress 2.1.8
• TablePress 2.2
• TablePress 2.2.1
• TablePress 2.2.2
• TablePress 2.2.3
• TablePress 2.2.4
• TablePress 2.2.5
• TablePress 2.3
• TablePress 2.3.1
• TablePress 2.3.2
• TablePress 2.4
• TablePress 2.4.1
• TablePress 2.4.2
• TablePress 2.4.3
• TablePress 2.4.4
• TablePress 3.0
• TablePress 3.0.1
• TablePress 3.0.2
• TablePress 3.0.3
• TablePress 3.0.4
• TablePress 3.1
• TablePress 3.1.1
• TablePress 3.1.2
• TablePress 3.1.3
• TablePress 3.2