CVE-2026-15301: BuddyHolis TableSearch WordPress Plugin Stored XSS Vulnerability

Technical summary

CVE-2026-15301 is a stored XSS vulnerability (CWE-79) affecting the BuddyHolis TableSearch WordPress plugin due to inadequate input sanitization and output escaping on the 'placeholder' parameter. The vulnerability requires authenticated access at Contributor level or above, meaning it affects multi-author WordPress installations where contributors are allowed to create or edit content. The injected payload persists in the database and executes in the browser context of any user viewing the compromised page, giving it wider reach than reflected XSS variants.

Business impact

For WordPress site owners relying on the TableSearch plugin, this vulnerability poses a reputational and operational risk. Malicious contributors or compromised contributor accounts could deface pages, inject phishing links, steal user data, or redirect visitors to malicious sites. Organizations with large contributor bases or external content partners face elevated risk, as the attack surface widens with each contributor account. The stored nature means the attack persists until the plugin is patched and malicious content is removed.

Affected systems

The BuddyHolis TableSearch WordPress plugin in all versions up to and including 1.1.0 is vulnerable. Any WordPress installation with this plugin active and configured to allow Contributor-level or higher access is at risk. Self-hosted WordPress sites are primarily affected, as plugin availability and update cadence depend on the site operator.

Exploitability

The vulnerability requires authentication, which limits exploitation to users with valid WordPress accounts at Contributor level or above. However, in multi-author sites, content agencies, or community-driven WordPress instances, contributor accounts are common and may be easier to compromise via phishing or credential stuffing than administrator accounts. Once exploited, the attack requires no user interaction—the malicious script runs automatically when others visit the page.

Remediation

Site operators should update the BuddyHolis TableSearch plugin to a patched version when available. Verify the latest version against the official plugin repository or vendor advisory. In the interim, restrict Contributor-level permissions to trusted users only, or consider deactivating the plugin if it is not actively in use. After patching, audit published content for malicious scripts and remove any injected payloads.

Patch guidance

Check the official BuddyHolis TableSearch plugin repository or the developer's website for an available security update. Apply the patch as soon as it is released and tested in a staging environment. WordPress administrators should enable automatic updates for plugins where possible to reduce the window of exposure. Verify patch deployment by confirming the plugin version in the WordPress admin dashboard reflects the updated release number.

Detection guidance

Monitor WordPress logs and plugin activity for unusual changes to pages using the TableSearch component. Website security scanners and WordPress security plugins (such as Wordfence or Sucuri) can help identify stored XSS payloads in page content. Review contributor account activity for unexpected edits, and audit database backups to identify when malicious content was first injected. Consider implementing a Web Application Firewall (WAF) rule to block common XSS patterns in form submissions and page edits.

Why prioritize this

Although the CVSS score of 6.4 (Medium) reflects the authentication requirement, the stored nature of the XSS and the potential for site-wide impact warrant timely patching. Organizations with multiple contributors, public-facing WordPress sites, or those accepting user-generated content should prioritize this update. The vulnerability does not require user interaction from victims and can compromise visitor trust and data security.

Risk score, explained

The CVSS:3.1 score of 6.4 (Medium) reflects a network-accessible vulnerability requiring low privilege (Contributor) and no user interaction for exploitation. The impact is limited to confidentiality and integrity (no availability impact), and the attack scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component. The authentication requirement prevents widespread, unauthenticated exploitation but does not eliminate risk in collaborative WordPress environments.

Frequently asked questions