WWordPress Vulnerability Database

Hong Kong Security Advisory Sheets2Table XSS(CVE20263619)

Cross Site Scripting (XSS) in WordPress Sheets2Table Plugin
0
Shares
0
0
0
0
Plugin Name Sheets2Table
Type of Vulnerability Cross-Site Scripting (XSS)
CVE Number CVE-2026-3619
Urgency Low
CVE Publish Date 2026-03-23
Source URL CVE-2026-3619

Sheets2Table (≤ 0.4.1) — Authenticated Contributor Stored XSS (CVE-2026-3619): What WordPress Site Owners Need to Know

By: Hong Kong Security Expert • 2026-03-23

TL;DR

A stored cross-site scripting (XSS) vulnerability (CVE-2026-3619) affects the Sheets2Table WordPress plugin versions up to and including 0.4.1. An authenticated user with Contributor privileges can inject JavaScript via the titles shortcode attribute. When the affected shortcode is rendered on the frontend, the malicious script executes in the context of visitors’ browsers — potentially including editors, administrators, or site visitors — enabling session theft, phishing, content injection, or persistence of other malicious code.

This post explains the vulnerability in plain language, outlines realistic threat scenarios, and provides step-by-step mitigation and remediation guidance you can apply immediately — including server-side hardening and generic virtual patching recommendations for WAFs.

Background — what happened

  • Software: Sheets2Table WordPress plugin
  • Vulnerable versions: ≤ 0.4.1
  • Vulnerability: Stored Cross-Site Scripting (XSS) via the titles shortcode attribute
  • Required privilege to inject: Contributor (authenticated)
  • CVSS (as published): 6.5 (medium)
  • Exploitation: Stored XSS — payload is stored and executed when the affected shortcode is rendered
  • User interaction: required (a privileged user needs to view the page or perform an action that triggers the stored payload)

Contributors are lower-privileged than Editors or Admins, but many editorial workflows allow Contributor input to be viewed by higher-privileged users — which is why stored XSS is useful to attackers.

Why this matters — threat scenarios

Stored XSS is a persistent and powerful vector. A contributor-level attacker can place a payload into a shortcode attribute that later executes in the browser of anyone viewing the page — including admins and editors. Typical exploitation outcomes include:

  • Session cookie or authentication token theft (leading to account takeover).
  • Unauthorized actions in the admin UI if the exploit triggers within an authenticated admin context.
  • Fraudulent forms or HTML/JS used to harvest credentials or payment details.
  • SEO spam, hidden links, or redirects to malware/phishing pages.
  • Delivery of second-stage backdoors using beacons or exfiltration of site details.

Even when advisories label a case “low” or “medium,” stored XSS warrants prompt attention because it can chain into more severe compromises.

How the vulnerability works (high level, non‑exploitative)

  1. The plugin exposes a shortcode such as [sheets2table titles="..."] that accepts a titles attribute.
  2. Input provided in the titles attribute is insufficiently sanitized on output and may be stored in the database as part of post content or meta.
  3. When the page is rendered, the plugin outputs the attribute value into the DOM without proper escaping or filtering, allowing embedded script or event handlers (e.g., <img onerror="...">, ">, or javascript: URIs) to execute.
  4. Because the payload is stored, the exploit persists across views until the stored content is cleaned.

No proof-of-concept is provided here. Responsible disclosure and remediation are the priorities. The following sections discuss detection, immediate mitigations and long-term remediation.

Who is at risk?

Assume risk if all three of the following apply to your site:

  1. Your site runs Sheets2Table version 0.4.1 or earlier.
  2. You allow Contributor (or higher) accounts to create content that can include shortcodes.
  3. You have pages or posts that include the Sheets2Table shortcode with the titles attribute.

If any condition is true, act promptly. Even if Contributors cannot publish directly, stored payloads may still be viewed by content reviewers and execute.

Immediate actions (what to do right now)

  1. Backup your site (files and database) before making changes.
  2. Disable or deactivate the Sheets2Table plugin until a safe update is available. If you cannot deactivate it, remove or disable pages that render the shortcode.
  3. Restrict or temporarily change user roles: suspend or demote suspicious Contributor accounts until you review recent content.
  4. Scan for and sanitize stored payloads (see “Database cleanup and forensic detection” below).
  5. Apply WAF virtual patching if you have a web application firewall available (guidance below).
  6. Force password resets for administrators and editors if you find evidence of exploitation.
  7. Enable or require two-factor authentication (2FA) for all privileged accounts.

WAF and virtual patching guidance (generic)

If you operate a web application firewall (WAF), you can deploy temporary rules to block common exploitation patterns while you perform cleanup. Use the rules below as a starting point and test in detect/log mode before enforcing.

Recommended rule patterns to block exploitation of the titles attribute:

  • Block POST/PUT requests to REST or admin endpoints that include the titles parameter with suspicious payloads (e.g. strings like <script, onerror=, onload=, javascript:, document.cookie, eval(, window.location).
  • Block or flag GET requests that render pages where the HTML contains <script fragments in shortcode contexts.
  • Deny requests that include suspicious base64-encoded payloads or known obfuscation patterns.

Example ModSecurity-style signature (illustrative — adapt to your WAF syntax and test first):

SecRule ARGS_NAMES|ARGS "@rx (?i)(titles).*(

Notes:

  • Test any rule in log/detect mode to avoid false positives.
  • Refine rules to target untrusted users or public requests if possible; avoid breaking legitimate admin workflows.
  • WAF rules are temporary mitigations — they do not replace proper code fixes and content cleanup.

Short-term developer mitigations (apply now)

If you are a developer and cannot wait for a plugin update, add a server-side filter that sanitizes the titles attribute when shortcode attributes are parsed. Use WordPress APIs such as wp_kses, esc_attr, and sanitize_text_field, and prefer a whitelist where feasible.

Example safe filter for the sheets2table shortcode (place in an mu-plugin or your theme's functions.php; mu-plugin preferred):

<?php
/**
 * Emergency mitigation: sanitize sheets2table shortcode titles attribute.
 * Create as mu-plugin (wp-content/mu-plugins/sheets2table-sanitize.php)
 */

add_filter('shortcode_atts_sheets2table', function($out, $pairs, $atts, $shortcode){
    if ( isset($out['titles']) ) {
        // Remove any HTML tags and decode common entities.
        $clean = wp_kses( $out['titles'], array() ); // strips all tags
        $clean = trim( sanitize_text_field( html_entity_decode( $clean, ENT_QUOTES | ENT_HTML5 ) ) );
        // Limit length to reduce potential encoding abuse
        $out['titles'] = mb_substr( $clean, 0, 1024 );
    }
    return $out;
}, 10, 4);

Notes:

  • Adjust the filter name if the shortcode differs — pattern is shortcode_atts_{$shortcode}.
  • Sanitizing attributes at parse time helps neutralize stored payloads upon rendering.
  • Also ensure admin/editor previews and any front-end rendering escape output appropriately.

Database cleanup and forensic detection

If you suspect exploitation, search the database for suspicious patterns associated with the titles attribute or shortcodes. Always run these commands on a backed-up copy of your database.

Search for <script> or event handlers inside content fields. WP-CLI examples (adjust quoting for your shell):

# Find posts containing 'sheets2table' shortcode
wp post list --post_type=post,page --format=ids --field=ID --post_status=any | \
xargs -n 50 -I % bash -c "wp post get % --field=post_content | grep -i 'sheets2table' && echo '--- post % ---'"

# Search DB for occurrences of