CVE-2025-8604: 
WordPress vulnerability analysis and mitigation

The WP Table Builder – WordPress Table Plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2025-8604) that affects all versions up to and including 2.0.12. The vulnerability was discovered and disclosed on August 15, 2025, and is related to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's wptb shortcode (NVD CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue stems from improper input sanitization and output escaping of user-supplied attributes in the plugin's wptb shortcode functionality. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD CVE, Wordfence).

The vulnerability allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages. These malicious scripts will execute whenever a user accesses an affected page, potentially leading to unauthorized access to sensitive information or manipulation of page content (NVD CVE).

Users are advised to update to a version newer than 2.0.12 once available. The vulnerability has been identified and reported, but at the time of disclosure, no official patch has been released (NVD CVE).