CVE-2026-56051

8th percentile — higher than 8% of all known CVEs

The TablePress plugin for WordPress versions 3.3.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code without requiring authentication.

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions in the victim's browser context. The risk is high because the attack does not require authentication.

Immediately update the TablePress plugin to the latest available version that fixes this vulnerability. Regularly check for updates for all WordPress plugins.