CVE-2026-6237 is a stored cross-site scripting vulnerability in the Quick Table WordPress plugin by rdcravens, affecting all versions up to 1.0.0. The issue is due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of the 'style' attribute in the 'qtbl' shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary JavaScript that executes in the context of users viewing the compromised pages. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity with no availability impact. No patch or official fix is currently documented.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. This can lead to unauthorized actions performed in the context of other users viewing the page, potentially compromising confidentiality and integrity of user data. There is no reported impact on availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and consider disabling or removing the Quick Table plugin if feasible. Monitor for updates from the vendor or security advisories for a patch or mitigation instructions.