CVE-2026-3619: Sheets2Table WordPress Plugin XSS Flaw

CVE-2026-3619 Overview

CVE-2026-3619 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Sheets2Table plugin for WordPress. The vulnerability exists in the titles shortcode attribute within the [sheets2table-render-table] shortcode, impacting all versions up to and including 0.4.1. Due to insufficient input sanitization and output escaping, authenticated attackers with Contributor-level access or above can inject malicious JavaScript that executes whenever users view the compromised page.

Critical Impact

Authenticated attackers can inject persistent malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or further compromise of WordPress installations.

Affected Products

• Sheets2Table WordPress Plugin versions ≤ 0.4.1
• WordPress installations with Sheets2Table plugin enabled
• Sites allowing Contributor-level or higher user access

Discovery Timeline

• 2026-03-21 - CVE-2026-3619 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3619

Vulnerability Analysis

This Stored XSS vulnerability stems from the unsafe handling of user-supplied input within the Sheets2Table plugin's shortcode processing functionality. The titles attribute in the [sheets2table-render-table] shortcode is passed through the S2T_Functions::trim_array_values() function, which performs only whitespace trimming without any security sanitization. The attribute value is then directly echoed into HTML using echo $header within a <th> tag in the display_table_header() function.

The absence of proper output escaping functions such as esc_html() allows attackers to break out of the expected HTML context and inject arbitrary JavaScript code. This is a classic Stored XSS pattern where malicious content is persisted in the database and executed each time the page is rendered.

Root Cause

The root cause is the lack of proper output escaping in the display_table_header() function located in class-sheets2table-tables.php. The plugin fails to sanitize the titles shortcode attribute before rendering it in HTML output. While the code does call trim_array_values(), this function only removes whitespace and provides no protection against XSS payloads. The correct remediation requires applying WordPress's built-in escaping functions like esc_html() or esc_attr() before outputting user-controlled data.

Attack Vector

The attack requires an authenticated user with at least Contributor-level privileges on the WordPress site. The attacker creates or edits a page/post containing the vulnerable shortcode with a malicious payload in the titles attribute. For example, an attacker could inject JavaScript event handlers or script tags that execute when the page is viewed by any user, including administrators.

The attack flow involves embedding malicious content within the shortcode syntax. When the page is rendered, the unescaped payload is output directly into the HTML table header, allowing script execution in the context of the victim's browser session. This can lead to session cookie theft, administrative account compromise, or website defacement.

For technical details on the vulnerable code paths, refer to the WordPress Plugin Code File and the WordPress Plugin Shortcode File.

Detection Methods for CVE-2026-3619

Indicators of Compromise

• Posts or pages containing [sheets2table-render-table] shortcodes with suspicious titles attribute values containing <script>, onerror, onload, or other event handlers
• Unexpected JavaScript execution when viewing pages with Sheets2Table tables
• Reports from users experiencing strange redirects or pop-ups when accessing specific pages
• Web Application Firewall (WAF) logs showing XSS pattern matches in shortcode content

Detection Strategies

• Review WordPress database for posts containing sheets2table-render-table shortcodes with potentially malicious content in the titles attribute
• Implement Content Security Policy (CSP) headers to detect and block inline script execution
• Monitor WordPress audit logs for Contributor-level users creating or modifying posts with shortcode content
• Use WordPress security plugins to scan for XSS patterns in post content

Monitoring Recommendations

• Enable real-time file integrity monitoring on WordPress installations
• Configure alerts for modifications to posts containing Sheets2Table shortcodes
• Implement browser-side XSS detection through CSP violation reporting
• Review user activity logs for accounts with Contributor access or above

How to Mitigate CVE-2026-3619

Immediate Actions Required

• Update the Sheets2Table plugin to a patched version if available
• Review all existing posts and pages for potentially malicious [sheets2table-render-table] shortcode content
• Temporarily deactivate the Sheets2Table plugin until a patch is applied
• Audit user accounts with Contributor-level access or higher and revoke privileges if unnecessary

Patch Information

Organizations should monitor the Wordfence Vulnerability Report for patch availability and update information. The fix requires implementing proper output escaping using WordPress functions such as esc_html() in the display_table_header() function before echoing the $header variable.

Workarounds

• Restrict Contributor-level access to trusted users only until patch is available
• Implement a Web Application Firewall (WAF) rule to block XSS patterns in shortcode attributes
• Use WordPress hooks to filter and sanitize shortcode attributes before rendering
• Consider using alternative table rendering plugins until the vulnerability is addressed

# Configuration example - Restrict contributor capabilities temporarily
# Add to wp-config.php or functions.php to remove contributor shortcode ability
# Note: Test in staging environment first

# Check installed Sheets2Table version
wp plugin list --name=sheets2table --fields=name,version,status

# Deactivate vulnerable plugin temporarily
wp plugin deactivate sheets2table

# Review posts with potentially malicious shortcodes
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%sheets2table-render-table%' AND post_content LIKE '%<script%'"