CVE-2025-5096: TablePress WordPress Plugin XSS Vulnerability

CVE-2025-5096 Overview

CVE-2025-5096 is a DOM-Based Stored Cross-Site Scripting [CWE-79] vulnerability in the TablePress plugin for WordPress. The flaw affects all versions of TablePress up to and including 3.1.2. It exists due to insufficient input sanitization and output escaping in the data-caption, data-s-content-padding, data-s-title, and data-footer data attributes handled by the bundled DataTables library.

Authenticated users with Contributor-level access or above can inject arbitrary JavaScript into table markup. The payload executes in the browser of any visitor who loads the affected page.

Critical Impact

Authenticated contributors can persist JavaScript payloads that execute in visitor and administrator browsers, enabling session theft, account takeover, and further site compromise.

Affected Products

• TablePress plugin for WordPress, all versions up to and including 3.1.2
• DataTables library versions bundled with TablePress prior to the escape-attributes patch
• WordPress sites accepting content from Contributor-level (or higher) accounts

Discovery Timeline

• 2025-05-23 - CVE-2025-5096 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5096

Vulnerability Analysis

TablePress bundles the DataTables JavaScript library to render interactive tables. DataTables reads configuration values directly from HTML5 data-* attributes on the table and cell elements. The library merges these values into runtime options and later writes several of them back into the DOM without HTML entity escaping.

An authenticated contributor who can create or edit table content can embed crafted data-caption, data-s-content-padding, data-s-title, or data-footer attributes. When the table is rendered, DataTables inserts the attacker-controlled string into the page, causing arbitrary script execution in the visitor's browser context.

Because the payload is stored in table content and executes for every viewer, an attacker can chain the flaw to hijack administrator sessions and pivot to full site takeover.

Root Cause

The root cause is the absence of output escaping in the DataTables constructor and column option handlers. Values returned by jqCell.data() and $this.data() were passed unchanged into option merging and DOM writes. The upstream fix introduces an _fnEscapeObject() helper gated by a new DataTable.ext.escape.attributes setting that HTML-escapes attribute values before use.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher and user interaction from a victim who views the poisoned page. The attack vector is network-based over the WordPress admin and public site surface.

// Patch: js/core/core.constructor.js
// Wrap $this.data() so attacker-controlled data-* attributes are escaped
_fnCamelToHungarian( defaults.column, defaults.column, true );

/* Setting up the initialisation object */
-_fnCamelToHungarian( defaults, $.extend( oInit, $this.data() ), true );
+_fnCamelToHungarian( defaults, $.extend( oInit, _fnEscapeObject($this.data()) ), true );

Source: DataTables commit d278ed3

// Patch: js/core/core.support.js
// New helper escapes HTML entities in objects derived from data-* attributes
+/**
+ * Escape HTML entities in strings, in an object
+ */
+function _fnEscapeObject(obj) {
+	if (DataTable.ext.escape.attributes) {
+		$.each(obj, function (key, val) {
+			obj[key] = _escapeHtml(val);
+		})
+	}
+
+	return obj;
+}

Source: DataTables commit d278ed3

// Patch: js/core/core.draw.js
// Apply the escape helper to per-column data attributes as well
				if ( write ) {
					if (unique) {
						// Allow column options to be set from HTML attributes
-						_fnColumnOptions( settings, shifted, jqCell.data() );
+						_fnColumnOptions( settings, shifted, _fnEscapeObject(jqCell.data()) );

Source: DataTables commit d558328

Detection Methods for CVE-2025-5096

Indicators of Compromise

• TablePress table content containing data-caption, data-s-content-padding, data-s-title, or data-footer attributes with <script>, javascript:, or event-handler payloads such as onerror= and onload=.
• Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages that embed TablePress tables.
• New or modified WordPress administrator accounts, plugin installations, or theme edits following Contributor-level content submissions.

Detection Strategies

• Query the wp_options and TablePress custom post storage for table cell content matching the vulnerable attribute names combined with script-like patterns.
• Enable Content Security Policy reporting and review script-src violations originating on pages that render TablePress shortcodes.
• Review WordPress audit logs for Contributor and Author accounts creating or editing tables, correlated with subsequent privileged actions.

Monitoring Recommendations

• Ingest WordPress access, admin, and PHP error logs into a centralized SIEM and alert on anomalous editing activity from low-privilege accounts.
• Monitor DOM mutations on customer-facing pages using client-side runtime application self-protection or browser telemetry.
• Track the installed TablePress version across all WordPress instances and alert on any host still running 3.1.2 or earlier.

How to Mitigate CVE-2025-5096

Immediate Actions Required

• Upgrade TablePress to version 3.1.3 or later on every WordPress instance where the plugin is installed.
• Audit existing tables for malicious payloads in the affected data-* attributes and remove or sanitize any suspicious content.
• Restrict who can hold Contributor-level or higher roles and rotate credentials for any account suspected of misuse.

Patch Information

TablePress 3.1.3 incorporates the upstream DataTables fixes that introduce the _fnEscapeObject() helper and the DataTable.ext.escape.attributes option. Review the TablePress 3.1.3 release announcement and the TablePress changeset 3298453 for the applied changes. Corresponding library fixes are documented in DataTables commit d278ed3 and DataTables commit d558328. Additional analysis is available in the Wordfence vulnerability report.

Workarounds

• Temporarily disable the TablePress plugin on affected sites until the upgrade to 3.1.3 can be applied.
• Remove Contributor and Author privileges from untrusted accounts and require editorial review before publishing table content.
• Deploy a Web Application Firewall rule that blocks requests containing <script> or JavaScript event handlers targeting TablePress admin endpoints.

# Verify the installed TablePress version and upgrade via WP-CLI
wp plugin get tablepress --field=version
wp plugin update tablepress --version=3.1.3
wp plugin status tablepress