CVE-2025-10053: TableGen WordPress Plugin XSS Vulnerability

CVE-2025-10053 Overview

CVE-2025-10053 is a Stored Cross-Site Scripting (XSS) vulnerability in the TableGen – Data Table Generator plugin for WordPress. The flaw affects all versions up to and including 1.3.1. The plugin fails to properly sanitize input and escape output in its admin settings interface. Authenticated attackers with administrator-level permissions can inject arbitrary web scripts. Injected scripts execute when users access affected pages. The issue is scoped to WordPress multi-site installations and single-site installations where the unfiltered_html capability has been disabled. This vulnerability is tracked under [CWE-79].

Critical Impact
An authenticated administrator on a multi-site or unfiltered_html-restricted WordPress instance can persist JavaScript that runs in the browser of any user who visits the affected pages.

Affected Products

WordPress TableGen – Data Table Generator plugin versions up to and including 1.3.1
WordPress multi-site network installations running the affected plugin
WordPress single-site installations where the unfiltered_html capability has been disabled

Discovery Timeline

2025-10-03 - CVE-2025-10053 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10053

Vulnerability Analysis

The TableGen plugin exposes administrative settings that accept user-supplied values without adequate input sanitization or output escaping. An authenticated administrator submits values containing HTML or JavaScript payloads. The plugin stores these values and later renders them on plugin-related pages within the WordPress dashboard or front-end views. Because the values are not escaped at render time, the browser interprets them as executable script. Any user who loads a page containing the injected content triggers execution in their session context. Exploitation requires administrator credentials, and the practical risk model is elevation beyond the unfiltered_html boundary rather than initial access.

Root Cause

The root cause is insufficient input sanitization on write and missing output escaping on read within the plugin's admin settings handlers. WordPress separates high-privilege HTML posting from general administration via the unfiltered_html capability. On multi-site installations and hardened sites, administrators do not hold this capability by default. The plugin bypasses this trust boundary by treating admin-submitted data as inherently safe.

Attack Vector

Exploitation follows the network attack path over HTTPS to the WordPress admin interface. An authenticated administrator without unfiltered_html submits a crafted payload through the plugin's settings form. The payload persists in the database and is later reflected into rendered pages. When a user, including higher-privileged super administrators, opens the affected view, the script executes in their browser session. This creates a path for cross-tenant script execution on WordPress multi-site networks, where administrators of one site are not trusted with raw HTML in other tenants.

No verified public exploit code is available for CVE-2025-10053. Technical details are described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-10053

Indicators of Compromise

Unexpected <script>, <iframe>, on*= event handler attributes, or javascript: URIs stored in TableGen plugin option rows within the wp_options or wp_sitemeta tables.
Outbound browser requests from admin sessions to unfamiliar third-party domains shortly after loading pages that render TableGen content.
Recent modifications to TableGen settings by administrator accounts that do not typically manage the plugin.

Detection Strategies

Query the WordPress database for TableGen option values containing HTML tags or JavaScript syntax and flag entries that deviate from expected configuration formats.
Enable WordPress audit logging to capture update_option and plugin-settings save events, then correlate with the administrator identity and source IP.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered pages.

Monitoring Recommendations

Monitor administrator account activity on multi-site networks for settings changes to installed plugins outside of change windows.
Alert on new administrator or super-administrator account creation events following any suspicious plugin settings modification.
Track browser telemetry from privileged users for anomalous DOM mutations or script loads on /wp-admin/ pages.

How to Mitigate CVE-2025-10053

Immediate Actions Required

Update the TableGen – Data Table Generator plugin to a version later than 1.3.1 once the vendor publishes a patched release. Refer to the plugin page on WordPress.org for the current version.
Audit all TableGen settings in every site of a multi-site network for stored HTML or JavaScript payloads and remove any unexpected content.
Review administrator accounts on affected sites and rotate credentials for any account exhibiting suspicious activity.

Patch Information

At the time of publication, the vendor references indicate the vulnerability is present in all versions up to and including 1.3.1. Site operators should consult the WordPress plugin repository and the Wordfence Vulnerability Report for the fixed release version and upgrade guidance.

Workarounds

Deactivate and remove the TableGen plugin from affected multi-site networks until a patched version is installed.
Restrict site-administrator role assignment on multi-site networks so that only trusted operators can access the plugin's settings interface.
Enforce a strict Content Security Policy that disallows inline scripts on /wp-admin/ pages to reduce the impact of stored payloads.

bash

# Configuration example: identify TableGen options containing script content
wp db query "SELECT option_id, option_name FROM wp_options \
  WHERE option_name LIKE '%table%creator%' \
  AND (option_value LIKE '%<script%' \
       OR option_value LIKE '%javascript:%' \
       OR option_value LIKE '%onerror=%');"