CVE-2025-9126: Smart Table Builder XSS Vulnerability

CVE-2025-9126 Overview

CVE-2025-9126 is a Stored Cross-Site Scripting (XSS) vulnerability in the Smart Table Builder plugin for WordPress. The flaw affects all versions up to and including 1.0.1. It stems from insufficient input sanitization and output escaping of the id parameter in the plugin's shortcode rendering logic.

Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The payload executes in the browser of any visitor who views the affected page, including administrators.

Critical Impact
Authenticated attackers with Contributor privileges can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, forced actions, and account takeover [CWE-79].

Affected Products

Smart Table Builder plugin for WordPress (versions ≤ 1.0.1)
WordPress sites running the vulnerable plugin with Contributor-level or higher user roles enabled
Any downstream deployment embedding the plugin's shortcode

Discovery Timeline

2025-09-06 - CVE-2025-9126 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9126

Vulnerability Analysis

The vulnerability resides in the render_frontend() function inside includes/Frontend.php. The function processes the id attribute passed to the plugin's shortcode and injects it directly into an HTML data-table-id attribute. No sanitization or output escaping is applied before concatenation into the final HTML string.

A Contributor-level user can craft a shortcode such as [smart_table id="...payload..."] within a post. When any user later renders that post, the attacker-controlled string breaks out of the attribute context and executes JavaScript in the visitor's browser session.

Because the attack scope is S:C, the injected script runs within the broader WordPress origin and can act against administrators who review pending Contributor submissions. Typical consequences include session cookie theft, forced administrative requests, and persistence through additional backdoors.

Root Cause

The root cause is missing input validation and missing output escaping on a user-controlled shortcode attribute. The original code passed the raw id value from wp_parse_args() directly into an HTML string, violating WordPress's output escaping guidance for attribute contexts.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges. The attacker inserts a malicious id value within the plugin's shortcode in post or page content. Execution occurs server-side rendering of the frontend when any user views the content, including unauthenticated visitors.

php

     * @return string
     */
    public function render_frontend( $atts, $content = '' ) {
-        $id = wp_parse_args($atts, ["id" => 0])['id'];
+        $id = absint( wp_parse_args($atts, ["id" => 0])['id'] );
        wp_enqueue_style( 'smart-table-builder-frontend' );
        wp_enqueue_script( 'smart-table-builder-frontend' );

-        $content .= "<div class=\"smart-table-builder-app\" data-table-id=$id></div>";
+        $content .= "<div class=\"smart-table-builder-app\" data-table-id=\"" . esc_attr( $id ) . "\"></div>";

        return $content;
    }

Source: GitHub Commit c9ca2ad. The patch applies absint() to coerce the id to a non-negative integer and wraps the attribute output in esc_attr() with proper quoting.

Detection Methods for CVE-2025-9126

Indicators of Compromise

Posts or pages authored by Contributor-level accounts containing the Smart Table Builder shortcode with unusually long or non-numeric id attribute values
Unexpected <script> tags, event handlers (for example onmouseover, onerror), or javascript: URIs rendered within smart-table-builder-app elements
Browser console errors or outbound requests to attacker-controlled domains originating from pages containing the plugin's shortcode
Administrator session anomalies, such as new administrator accounts or plugin installations following review of Contributor submissions

Detection Strategies

Audit the wp_posts table for shortcode usage patterns such as [smart_table combined with suspicious id values that are not strictly numeric
Deploy a web application firewall rule that blocks shortcode attribute values containing HTML metacharacters (<, >, ", ') submitted by non-administrator roles
Monitor WordPress audit logs for post edits by Contributors immediately followed by administrator previews of the same content

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution violations originating from pages that embed the plugin
Alert on creation of new WordPress users with elevated roles, especially shortly after Contributor-authored content is reviewed
Correlate web server access logs with authentication events to identify session hijacking indicators following page views

How to Mitigate CVE-2025-9126

Immediate Actions Required

Update the Smart Table Builder plugin to the patched version released after 1.0.1 that includes WordPress Changeset #3351768
Review all posts and pages containing the Smart Table Builder shortcode for malicious id attribute values and remove or sanitize them
Rotate administrator session cookies and reset credentials for any admin who may have previewed Contributor-authored content
Restrict Contributor-level account creation and audit existing Contributor accounts for legitimacy

Patch Information

The vendor fix is committed in GitHub commit c9ca2ad and shipped in WordPress Changeset #3351768. The patch forces the id value through absint() and escapes attribute output using esc_attr(). Full technical analysis is available in the Wordfence Vulnerability Report.

Workarounds

Deactivate the Smart Table Builder plugin until the patched release can be installed
Temporarily restrict shortcode usage for Contributor accounts using role management plugins or a custom kses filter
Apply a WAF rule that blocks shortcode attribute values containing angle brackets or quoting characters

bash

# Update the plugin via WP-CLI once a patched version is available
wp plugin update smart-table-builder

# Or disable the plugin as an interim measure
wp plugin deactivate smart-table-builder

# Audit posts for suspicious shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts WHERE post_content LIKE '%[smart_table%' AND post_content REGEXP 'id=\"[^0-9\"]';"