CVE-2026-6237: Quick Table WordPress Plugin XSS Vulnerability

CVE-2026-6237 Overview

CVE-2026-6237 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting the Quick Table plugin for WordPress in all versions up to and including 1.0.0. The flaw resides in the style attribute of the qtbl shortcode, which the plugin fails to sanitize or escape before rendering. Authenticated users with contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The injected scripts run in the context of the WordPress site, enabling session theft, content manipulation, and redirection attacks.

Critical Impact
Authenticated contributors can persist malicious JavaScript into published pages, executing in the context of every visitor — including administrators.

Affected Products

Quick Table plugin for WordPress — all versions through 1.0.0
WordPress sites permitting contributor-level (or higher) user registration
Any WordPress installation rendering pages containing the qtbl shortcode

Discovery Timeline

2026-05-12 - CVE-2026-6237 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-6237

Vulnerability Analysis

The Quick Table plugin registers the qtbl shortcode to render HTML tables inside WordPress posts and pages. The shortcode accepts user-supplied attributes, including a style attribute that is concatenated directly into the rendered table markup. The plugin neither sanitizes the input with WordPress functions such as esc_attr() nor restricts the value to safe CSS properties.

Because the attribute is echoed inside an HTML element, attackers can break out of the attribute context using quote characters and event-handler attributes such as onmouseover or onerror. The payload is stored persistently in the post content, making this a stored (persistent) XSS rather than reflected. Stored XSS in WordPress is particularly impactful because the payload fires for every visitor who renders the affected post.

Root Cause

The root cause is missing input sanitization and missing output escaping in the shortcode handler defined in qtbl.php. User-controlled values flow from shortcode attributes into HTML output without passing through esc_attr(), wp_kses(), or an equivalent allowlist. WordPress's shortcode API does not perform sanitization automatically — the responsibility rests with the plugin author.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. An attacker creates or edits a post that contains a qtbl shortcode with a crafted style attribute. The payload breaks the HTML attribute boundary and introduces an event handler containing JavaScript. When an administrator previews the post or any visitor loads the published page, the injected script executes with the privileges of the viewing user. Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Source Code for the affected handler location.

Detection Methods for CVE-2026-6237

Indicators of Compromise

Posts or pages containing [qtbl ...] shortcodes with style attribute values that include ", <, >, onerror, onmouseover, javascript:, or expression( substrings
Unexpected outbound requests from visitor browsers to attacker-controlled domains after rendering plugin-managed pages
New or modified administrator accounts created shortly after a contributor account edits a page using the plugin

Detection Strategies

Query the wp_posts table for post_content containing the qtbl shortcode and inspect each style attribute for HTML-breaking characters
Review WordPress audit logs for post edits performed by contributor or author accounts that introduce shortcode attributes
Enable a Content Security Policy (CSP) in report-only mode to surface inline script execution originating from plugin-rendered pages

Monitoring Recommendations

Alert on creation of WordPress accounts at contributor level or higher and correlate with subsequent post edits
Monitor for administrator session activity originating from unexpected geolocations following page renders
Track changes to plugin files under wp-content/plugins/quick-table/ and compare against the upstream 1.0.0 source

How to Mitigate CVE-2026-6237

Immediate Actions Required

Deactivate and remove the Quick Table plugin until a patched release is available
Audit all existing posts containing the qtbl shortcode and remove any suspicious style attribute payloads
Restrict contributor and author registration on public-facing WordPress sites and review the legitimacy of existing low-privilege accounts
Rotate administrator session cookies and credentials if injection is suspected

Patch Information

At the time of publication, no fixed version of the Quick Table plugin has been published beyond 1.0.0. Monitor the WordPress Plugin Repository and the Wordfence Vulnerability Analysis for an updated release that applies esc_attr() or wp_kses() to shortcode attributes.

Workarounds

Remove the plugin and replace shortcode usage with native WordPress block tables
Apply a Web Application Firewall (WAF) rule that blocks requests containing qtbl shortcodes with quote characters or event-handler keywords in attribute values
Enforce a strict Content Security Policy that disallows inline scripts and inline event handlers across the WordPress front end

bash

# Example WAF/ModSecurity rule pattern to block crafted qtbl shortcodes
SecRule ARGS "@rx \[qtbl[^\]]*style\s*=\s*[\"'][^\"']*(on\w+\s*=|javascript:|<script)" \
    "id:1026637,phase:2,deny,status:403,msg:'CVE-2026-6237 Quick Table XSS attempt'"