A table’s datetime format string was interpolated straight into an inline JavaScript command without escaping, so a value containing a quote could break out and execute script in the browser of anyone viewing the table. The format string is now passed through wp_json_encode with JSON_HEX_TAG, which escapes quotes and angle brackets.
This vulnerability affects the following application versions:
- TablePress 3.0
- TablePress 3.0.1
- TablePress 3.0.2
- TablePress 3.0.3
- TablePress 3.0.4
- TablePress 3.1
- TablePress 3.1.1
- TablePress 3.1.2
- TablePress 3.1.3
- TablePress 3.2
- TablePress 3.2.1
- TablePress 3.2.2
- TablePress 3.2.3
- TablePress 3.2.4