CVE-2025-2685 Overview
CVE-2025-2685 is a stored cross-site scripting (XSS) vulnerability in the TablePress plugin for WordPress [CWE-79]. The flaw affects all versions up to and including 3.0.4 and resides in the handling of the table-name parameter. Insufficient input sanitization and output escaping allow authenticated users with Author-level access or higher to inject arbitrary web scripts. The injected scripts execute whenever another user, including administrators, accesses the affected page.
Critical Impact
Authenticated attackers with Author-level permissions can store malicious JavaScript that executes in the browsers of site visitors and administrators, enabling session theft, admin takeover, or further site compromise.
Affected Products
- TablePress plugin for WordPress, versions ≤ 3.0.4
- WordPress sites allowing Author-level or higher accounts
- Any WordPress installation using TablePress table management features
Discovery Timeline
- 2025-03-27 - CVE-2025-2685 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2685
Vulnerability Analysis
TablePress fails to sanitize user input supplied through the table-name parameter before storing it in the database. The plugin also neglects to escape this value when rendering it in the administrative table listing view. This combination creates a persistent XSS condition that executes on every page load.
The vulnerability requires authenticated access at Author level or above, limiting mass exploitation. However, WordPress environments with open author registration or multiple content contributors face meaningful risk. Attackers can leverage the injection to escalate privileges by hijacking administrator sessions.
Root Cause
The root cause is improper neutralization of input during web page generation [CWE-79]. The affected view responsible for rendering table listings outputs the stored table-name value without applying WordPress escaping functions such as esc_html() or esc_attr(). The code location is referenced in the TablePress source for class-all-tables-list-table.php.
Attack Vector
An authenticated attacker with Author-level permissions creates or edits a TablePress table and injects JavaScript payloads into the table-name field. The payload persists in the WordPress database. When any authenticated user, including an administrator, visits the TablePress tables administration page, the browser renders and executes the stored script in the context of the WordPress admin domain.
Exploitation requires user interaction (UI:R) because a victim must load the affected admin page. The scope-changed CVSS vector indicates the impact extends beyond the vulnerable component to the broader WordPress session context. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-2685
Indicators of Compromise
- TablePress table records containing HTML tags such as <script>, onerror=, or onload= within the table-name field
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after visiting the TablePress admin screen
- New administrator accounts or modified user roles created shortly after an Author user edited a table
- WordPress audit log entries showing table name changes containing non-standard characters
Detection Strategies
- Query the wp_options or TablePress storage tables for entries whose table names contain angle brackets, event handlers, or JavaScript URI schemes
- Review WordPress activity logs for Author-level accounts creating or renaming tables with unusual payloads
- Deploy a web application firewall ruleset that inspects POST requests to admin.php?page=tablepress for script content in form fields
Monitoring Recommendations
- Monitor administrative sessions for anomalous API calls originating from the TablePress admin pages
- Alert on privilege escalation events, including role changes and new user creation, correlated with recent TablePress activity
- Track plugin version inventory across WordPress deployments to confirm all instances are above version 3.0.4
How to Mitigate CVE-2025-2685
Immediate Actions Required
- Update the TablePress plugin to the version released in WordPress Changeset #3261229, which supersedes 3.0.4
- Audit all existing TablePress tables for malicious content in the table-name field and remove any script payloads
- Review Author-level and higher user accounts, removing any that are unused or unauthorized
- Rotate administrator passwords and invalidate active sessions if exploitation is suspected
Patch Information
The TablePress maintainers addressed the vulnerability by adding proper output escaping in the affected view. The fix is tracked in WordPress Changeset #3261229. Site operators should install the patched version through the WordPress plugin updates interface or via WP-CLI.
Workarounds
- Restrict Author-level and higher roles to trusted users only until patching is complete
- Temporarily deactivate the TablePress plugin on sites where patching cannot be applied immediately
- Apply a WAF rule to block requests containing script tags in the table-name POST parameter
- Enforce Content Security Policy headers that disallow inline script execution in the WordPress admin interface
# Update TablePress via WP-CLI
wp plugin update tablepress
# Verify installed version is greater than 3.0.4
wp plugin get tablepress --field=version
# Optional: deactivate until patched
wp plugin deactivate tablepress
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
