The WP Table Builder plugin for WordPress versions up to and including 2.1.7 contains a stored cross-site scripting (XSS) vulnerability via the 'url' parameter. This flaw allows authenticated users with contributor-level permissions or higher to inject malicious scripts that execute when a user views the affected page. Lower-privileged users can exploit this only if explicitly permitted by an administrator in plugin settings.