The TableGen – Data Table Generator plugin for WordPress suffers from a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping in admin settings. This allows authenticated administrators to inject arbitrary scripts that execute in the context of users visiting the injected pages. The issue specifically impacts multi-site WordPress installations and those where the unfiltered_html capability is disabled. The vulnerability is tracked as CVE-2025-10053 with a CVSS 3.1 base score of 4.4, indicating medium severity. No patch or official remediation has been documented in the provided information.

An attacker with administrator-level permissions on affected WordPress installations can inject malicious scripts that execute in the browsers of users viewing the compromised pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed in the context of the victim user. Availability is not affected. The vulnerability is constrained by the requirement for high privileges and specific WordPress configurations (multi-site and unfiltered_html disabled).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or removing the TableGen – Data Table Generator plugin in multi-site environments or where unfiltered_html is disabled. Monitor vendor channels for updates and apply patches promptly once released.