CVE-2026-15301 Overview
CVE-2026-15301 is a Stored Cross-Site Scripting (XSS) vulnerability in the BuddyHolis TableSearch plugin for WordPress. The flaw affects all versions up to and including 1.1.0 and stems from insufficient input sanitization and output escaping on the placeholder parameter. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when other users view an affected page. The vulnerability is tracked under [CWE-79] and requires low privileges with no user interaction to trigger script execution against visitors.
Critical Impact
Contributor-level users can persist malicious JavaScript in WordPress pages, enabling session theft, administrative action hijacking, and browser-based attacks against site visitors and administrators.
Affected Products
- BuddyHolis TableSearch plugin for WordPress, versions through 1.1.0
- WordPress sites that allow Contributor-level or higher account registration
- Any page rendering the vulnerable placeholder parameter
Discovery Timeline
- 2026-07-10 - CVE-2026-15301 published to NVD
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-15301
Vulnerability Analysis
The BuddyHolis TableSearch plugin renders a searchable table interface driven by shortcode attributes. The placeholder attribute, which populates the HTML search input, is written into the page output without adequate sanitization or escaping. An authenticated attacker with Contributor-level access can supply crafted markup through this attribute, embedding executable JavaScript into the stored post content.
When a subsequent visitor loads the affected page, the injected script executes in the visitor's browser under the site's origin. This enables theft of authentication cookies, forced administrative actions via the visitor's session, redirection to attacker infrastructure, and defacement. Because the payload is stored in the database, exploitation is persistent and does not require additional attacker interaction after injection.
Root Cause
The root cause is missing output escaping on the placeholder shortcode attribute in the plugin's rendering routine at tablesearch.php line 33. The plugin concatenates the user-controlled value directly into an HTML context without applying WordPress escaping functions such as esc_attr(). See the WordPress Plugin Code Review for the vulnerable source.
Attack Vector
Exploitation requires an authenticated account with Contributor role or higher on the target WordPress site. The attacker creates or edits a post containing the TableSearch shortcode and supplies a malicious placeholder value that breaks out of the HTML attribute context. Refer to the Wordfence Vulnerability Analysis for additional details on exploitation conditions.
Detection Methods for CVE-2026-15301
Indicators of Compromise
- Post or page content containing TableSearch shortcodes with placeholder values that include <script>, onerror, onload, or javascript: fragments
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages using the TableSearch plugin
- New administrative users or role changes created shortly after a Contributor account edits a page containing the shortcode
Detection Strategies
- Audit the wp_posts table for TableSearch shortcodes and inspect the placeholder attribute for HTML control characters or script keywords
- Review WordPress activity logs for post edits performed by Contributor-level accounts that introduce or modify TableSearch shortcodes
- Deploy a web application firewall rule that flags shortcode attributes containing angle brackets, event handlers, or scheme prefixes
Monitoring Recommendations
- Enable content integrity monitoring on published posts and pages that render the TableSearch shortcode
- Alert on newly created Contributor, Author, or Editor accounts, particularly those that publish or edit content immediately after registration
- Monitor browser-side error telemetry and Content Security Policy (CSP) violation reports for scripts loaded from unexpected origins
How to Mitigate CVE-2026-15301
Immediate Actions Required
- Deactivate the BuddyHolis TableSearch plugin until a patched release is available
- Review all posts containing TableSearch shortcodes and remove any suspicious placeholder values
- Restrict Contributor-level and higher account creation and audit existing low-privilege accounts for legitimacy
- Rotate credentials and invalidate active sessions for administrators who may have viewed injected pages
Patch Information
As of the NVD publication date, no fixed version has been indicated for the BuddyHolis TableSearch plugin. Administrators should monitor the WordPress plugin repository and the Wordfence advisory for release of a version above 1.1.0 that applies proper escaping to the placeholder attribute.
Workarounds
- Remove the TableSearch shortcode from all published content until a fix is released
- Configure a Content Security Policy that disallows inline scripts to reduce the impact of stored XSS payloads
- Apply a WAF rule to strip HTML control characters from shortcode attributes in POST requests to wp-admin/post.php
- Downgrade Contributor accounts to Subscriber where publishing is not required
# Configuration example: disable the plugin via WP-CLI
wp plugin deactivate tablesearch
wp plugin delete tablesearch
# Audit posts for the vulnerable shortcode
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[tablesearch%' AND post_content LIKE '%placeholder=%';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
