{"id":"CVE-2026-118189","title":"Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute","summary":"The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping.…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"barn2media","product":"Posts Table with Search & Sort","affected":["posts_table_with_search_sort <= 1.4.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T14:59:37.359499Z"},"published":"2026-11-06","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:03:16.142Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-118189","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/4ac45e56-606a-445f-84ec-349b68109065?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Simple_Posts_Table.php#L338"},{"url":"https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Simple_Posts_Table.php#L345"},{"url":"https://plugins.trac.wordpress.org/browser/posts-data-table/tags/1.4.14/src/Table_Shortcode.php#L33"},{"url":"https://plugins.trac.wordpress.org/changeset/3780094/posts-data-table/trunk/src/Simple_Posts_Table.php"}],"tags":["cve.org"],"epss":0.00207,"epssPercentile":0.10905,"ingestedAt":"2026-11-06T08:48:01.703Z","slug":"CVE-2026-118189","body":"## Overview\n\nThe Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post at save time because it contains no literal angle bracket characters; the malicious HTML tags are only reconstructed at render time, making this exploitable by Contributors who would ordinarily lack the unfiltered_html capability.\n\n## Affected\n\n- `posts_table_with_search_sort <= 1.4.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}