Cross‑Site Scripting (XSS) - Table Content about tablepress

[TobiasBg]

Hi @nullfil3,

thanks for your report, I really appreciate it!

According to your screenshots, you were logged-in as an Administrator when you submitted the payload.
Administrator and Editor users are permitted to submit unfiltered HTML and JavaScript. WordPress (and TablePress) allows them to do this. These users have the unfiltered_html capability, see https://wordpress.org/support/article/roles-and-capabilities/#unfiltered_html.
This is not a security vulnerability in the WordPress eco-system.
You can test this yourself by adding the following to your wp-config.php file, which disables this capability:
define( 'DISALLOW_UNFILTERED_HTML', true );
You will notice that with this constant set to true, that you will not be able to reproduce your issue.
You can read more about this at https://make.wordpress.org/core/handbook/testing/reporting-security-vulnerabilities/#why-are-some-users-allowed-to-post-unfiltered-html

Best wishes,
Tobias

[nullfd]

OK! thanks for the feedback, i've read about "DISALLOW_UNFILTERED_HTML" but for me this behavior is for all users include admin.

[TobiasBg]

Hi @nullfil3,

do you mean that you can recreate this issue while you are logged-in into WordPress as a user that only has the "Author" role? I could not reproduce this in my tests...

Regards,
Tobias