CVE-2025-9500: TablePress WordPress Plugin XSS Vulnerability

CVE-2025-9500 Overview

CVE-2025-9500 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the TablePress plugin for WordPress in all versions up to and including 3.2. The flaw resides in the handling of the shortcode_debug parameter, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript. Injected payloads execute in the browser of any user visiting an affected page. TablePress is a widely deployed WordPress plugin used for creating and managing HTML tables, making this an exposure that can affect content editors and site visitors alike.

Critical Impact
Authenticated Contributor-level attackers can persist arbitrary JavaScript in WordPress pages, enabling session theft, administrative action hijacking, and content manipulation against any visiting user.

Affected Products

TablePress plugin for WordPress, all versions through 3.2
WordPress sites that permit Contributor-level or higher registration
Sites relying on TablePress shortcode rendering for table content

Discovery Timeline

2025-08-30 - CVE-2025-9500 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-9500

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the TablePress frontend controller. When the plugin processes the shortcode_debug parameter, it fails to properly sanitize input before storage and does not escape output when the value is later rendered on a page. An authenticated user with Contributor privileges or higher can supply a crafted payload that persists in the site's database. When any user subsequently loads a page containing the injected shortcode, the payload executes within their browser session under the origin of the WordPress site. Because execution occurs in the visitor's context, attackers can steal session cookies, perform actions on behalf of administrators, or pivot to broader site compromise via the WordPress admin interface.

Root Cause

The root cause is missing input sanitization and missing output escaping around the shortcode_debug parameter in the TablePress frontend controller. The relevant handling can be reviewed in the plugin source at TablePress Frontend Controller Code and TablePress Frontend Controller Code. WordPress provides sanitize_text_field() and esc_html() / esc_attr() helpers for this purpose, but they were not consistently applied to the debug parameter path.

Attack Vector

Exploitation requires an authenticated account at Contributor level or above. The attacker submits a shortcode containing a malicious shortcode_debug value through normal content authoring workflows. The payload is stored in post content and rendered on any page that displays the affected shortcode. Because the vulnerability changes the scope of impact from the attacker's account to any visiting user, including administrators, it enables privilege escalation through cookie theft or forced administrative actions. The fix landed in WordPress Changeset #3352096.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2025-9500

Indicators of Compromise

Post or page content containing TablePress shortcodes with a shortcode_debug attribute that includes HTML tags, <script> fragments, or event handlers such as onerror= or onload=
Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendering TablePress tables
New or modified WordPress administrative accounts created shortly after Contributor-level content edits

Detection Strategies

Query the wp_posts table for entries containing the string shortcode_debug combined with <, javascript:, or on\w+= patterns
Review WordPress audit logs for post edits by Contributor-level accounts that add or modify TablePress shortcodes
Deploy a Web Application Firewall (WAF) rule to flag POST requests to wp-admin/post.php containing shortcode_debug values with script-like tokens

Monitoring Recommendations

Monitor WordPress plugin inventory for TablePress installations at version 3.2 or below
Alert on newly created Contributor, Author, or Editor accounts, particularly on sites that permit open registration
Track Content Security Policy (CSP) violation reports for inline script execution originating from published pages

How to Mitigate CVE-2025-9500

Immediate Actions Required

Update the TablePress plugin to the version above 3.2 that includes WordPress Changeset #3352096
Audit all posts and pages that reference TablePress shortcodes for injected payloads and remove malicious content
Rotate WordPress administrator session cookies and passwords if evidence of exploitation is present
Review Contributor, Author, and Editor accounts and remove any that are unrecognized or unnecessary

Patch Information

The vendor addressed CVE-2025-9500 in a TablePress release following version 3.2. The upstream fix is tracked in WordPress Changeset #3352096 and adds proper sanitization and escaping around the shortcode_debug parameter. Additional developer notes are available in the TablePress Developer Documentation.

Workarounds

Restrict Contributor-level and higher access to trusted users only until the patch is applied
Deploy a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS execution
Configure a WAF rule to block requests containing shortcode_debug attributes with HTML or script tokens
Temporarily disable the TablePress plugin on high-value sites if patching cannot be completed immediately

bash

# Update TablePress via WP-CLI to the latest patched version
wp plugin update tablepress

# Verify installed version is above 3.2
wp plugin get tablepress --field=version

# Audit posts for suspicious shortcode_debug usage
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%shortcode_debug%' AND post_content REGEXP '<script|onerror=|onload=';"