{"id":"CVE-2026-2982","aliases":["EUVD-2026-124348","GHSA-hhqx-3c3m-8wf4"],"status":"published","title":"WP Table Builder – Drag \u0026 Drop Table Builder \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'","description":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.00173,"percentile":0.06812,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-12T11:32:16Z","modified":"2026-11-12T12:31:45Z","products":[{"vendor":"wptb","product":"wp table builder – drag \u0026 drop table builder"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07a08ad-c9b7-44fe-a199-fa8bb7f3eea2?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset/3469639/wp-table-builder"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2982"},{"url":"https://github.com/advisories/GHSA-hhqx-3c3m-8wf4"}],"sources":{"cve":[{"id":"CVE-2026-2982","title":"WP Table Builder – Drag \u0026 Drop Table Builder \u003c= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'","description":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.","status":"published","published":"2026-11-12T11:32:16.664Z","modified":"2026-11-12T11:32:16.664Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T12:42:25.726487Z"}],"euvd":[{"id":"EUVD-2026-124348","description":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.","status":"published","published":"2026-11-12T11:32:16Z","modified":"2026-11-12T11:32:16Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-12T14:33:51.403529Z"}],"ghsa":[{"id":"GHSA-hhqx-3c3m-8wf4","title":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored...","description":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.","status":"published","published":"2026-11-12T12:31:37Z","modified":"2026-11-12T12:31:45Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T12:41:04.410575Z"}],"nvd":[{"id":"CVE-2026-2982","description":"The WP Table Builder – Drag \u0026 Drop Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in versions up to, and including, 2.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation by lower-privileged users requires an administrator to explicitly allow those roles in plugin settings. While it is possible to assign subscriber-level roles with the ability to create tables, such privileges are usually assigned to the more appropriate contributor, author, or editor level roles.","status":"published","published":"2026-11-12T12:18:24.393Z","modified":"2026-11-12T12:18:24.527Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-12T13:31:11.73784Z"}]}}