CVE-2025-9543: FlexTable WordPress Plugin XSS Vulnerability

CVE-2025-9543 Overview

The FlexTable WordPress plugin before version 3.19.2 contains a Stored Cross-Site Scripting (XSS) vulnerability due to insufficient sanitization and escaping of imported links from Google Sheet cells. This vulnerability allows high-privilege users such as administrators to inject malicious scripts that persist in the application, even when the unfiltered_html capability is explicitly disallowed, such as in WordPress multisite configurations.

Critical Impact

Administrators can bypass WordPress security restrictions to inject persistent malicious scripts through Google Sheet imports, potentially compromising other administrators or users viewing affected tables in multisite environments.

Affected Products

• FlexTable WordPress plugin versions prior to 3.19.2
• WordPress installations using FlexTable with Google Sheets integration
• WordPress multisite environments with restricted unfiltered_html capability

Discovery Timeline

• 2026-01-05 - CVE CVE-2025-9543 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-9543

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability exists in the FlexTable plugin's Google Sheets import functionality. When administrators import data from Google Sheets, the plugin fails to properly sanitize and escape link content contained within cells. This allows malicious JavaScript payloads embedded in Google Sheet hyperlinks to be stored in the WordPress database and executed in the context of users viewing the affected tables.

The vulnerability is particularly concerning in WordPress multisite environments where the unfiltered_html capability is intentionally disabled to prevent administrators from injecting arbitrary HTML and JavaScript. This security control is designed to protect against malicious or compromised administrators in shared hosting scenarios. The FlexTable vulnerability effectively bypasses this protection mechanism.

Root Cause

The root cause is improper input validation and output encoding in the plugin's Google Sheets import handler. When processing imported spreadsheet data, the plugin trusts link content from external sources without adequately sanitizing it before storage or escaping it during output rendering. This violates the security principle of treating all external input as untrusted.

Attack Vector

The attack requires an authenticated user with administrative privileges to import a specially crafted Google Sheet containing malicious JavaScript payloads within cell hyperlinks. The attack vector is network-based, requiring the attacker to have administrator access to the WordPress installation. Once the malicious content is imported, the stored XSS payload executes whenever any user views the affected table content.

An attacker would prepare a Google Sheet with cells containing hyperlinks that include JavaScript in the href attribute or event handlers. Upon import through FlexTable, these malicious scripts are stored and later rendered without proper escaping, leading to script execution in victims' browsers.

Detection Methods for CVE-2025-9543

Indicators of Compromise

• Unexpected JavaScript code or event handlers in FlexTable-generated table content
• Suspicious <script> tags or inline event handlers (onclick, onerror, etc.) in database entries associated with FlexTable
• User reports of unexpected browser behavior or popups when viewing FlexTable-rendered content
• Unusual network requests originating from pages containing FlexTable elements

Detection Strategies

• Review FlexTable database entries for malicious script patterns or encoded JavaScript payloads
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor WordPress database for suspicious HTML/JavaScript content in FlexTable-related tables
• Audit administrator activity logs for Google Sheet imports, particularly from untrusted sources

Monitoring Recommendations

• Enable WordPress audit logging to track plugin configuration changes and data imports
• Deploy web application firewall (WAF) rules to detect and alert on XSS payload patterns
• Implement browser-based XSS detection mechanisms such as CSP violation reporting
• Regularly scan WordPress database content for known XSS attack signatures

How to Mitigate CVE-2025-9543

Immediate Actions Required

• Update FlexTable WordPress plugin to version 3.19.2 or later immediately
• Audit existing FlexTable content for any injected malicious scripts
• Review and sanitize any previously imported Google Sheet data
• Temporarily disable the Google Sheets import feature if immediate patching is not possible

Patch Information

The vulnerability is resolved in FlexTable version 3.19.2. Users should update to this version or later through the WordPress plugin management interface or by downloading from the official WordPress plugin repository. Additional details are available in the WPScan Vulnerability Details.

Workarounds

• Disable the FlexTable plugin's Google Sheets import functionality until the patch is applied
• Implement server-side input sanitization at the web server level to filter potentially malicious content
• Restrict administrator access in multisite environments to trusted users only
• Deploy Content Security Policy headers to mitigate the impact of any stored XSS payloads

# Add Content Security Policy header to mitigate XSS impact
# Add to .htaccess or server configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"