Tablesome Vulnerabilities

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVSS:

7.5

Affected:

up to 1.2.9

Fix:

No patched version reported

Disclosed:

Aug 11, 2026

CVE-2026-66659 on NVD →

The Tablesome plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.1.30. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.1.30

Fixed in:

1.1.31

Disclosed:

Jul 7, 2026

CVE-2026-14924 on NVD →

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can succe...

CVSS:

6.1

Affected:

up to 1.1.13

Fixed in:

1.1.17

Disclosed:

Apr 30, 2026

CVE-2024-13362 on NVD →

[en] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome tablesome allows Blind SQL Injection.This issue affects Tablesome: from n/a through <= 1.2.3.

Affected:

up to 1.2.3

Fix:

No patched version reported

Disclosed:

Mar 5, 2026

CVE-2026-27373 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.2.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVSS:

6.5

Affected:

up to 1.2.3

Fixed in:

1.2.4

Disclosed:

Feb 24, 2026

CVE-2026-27373 on NVD →

[en] The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authentica...

Affected:

up to 1.2.2

Fixed in:

1.2.2

Disclosed:

Feb 19, 2026

CVE-2025-12845 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function in versions 0.5.4 to 1.2.1. This makes it possible for authenticated a...

CVSS:

8.8

Affected:

0.5.4 – 1.2.1

Fixed in:

1.2.2

Disclosed:

Feb 18, 2026

CVE-2025-12845 on NVD →

The Tablesome plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.2.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.2.8

Fixed in:

1.2.9

Disclosed:

Jan 26, 2026

CVE-2026-24524 on NVD →

[en] Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.2.

Affected:

up to 1.1.35.2

Fix:

No patched version reported

Disclosed:

Jan 23, 2026

CVE-2026-24524 on NVD →

[en] Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.35.1.

Affected:

up to 1.1.35.1

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68517 on NVD →

[en] Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Tablesome: from n/a through <= 1.1.35.1.

Affected:

up to 1.1.35.1

Fix:

No patched version reported

Disclosed:

Dec 24, 2025

CVE-2025-68516 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.35.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or...

CVSS:

6.5

Affected:

up to 1.1.35.1

Fixed in:

1.1.35.2

Disclosed:

Dec 22, 2025

CVE-2025-68516 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.35.1. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVSS:

4.3

Affected:

up to 1.1.35.1

Fixed in:

1.1.35.2

Disclosed:

Dec 22, 2025

CVE-2025-68517 on NVD →

[en] Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.34.

Affected:

up to 1.1.34

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-66526 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.1.34. This makes it possible for authenticated attackers, with Contributor-level access and...

CVSS:

4.3

Affected:

up to 1.1.34

Fixed in:

1.1.35.1

Disclosed:

Dec 5, 2025

CVE-2025-66526 on NVD →

[en] The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthen...

Affected:

up to 1.3.33

Fixed in:

1.3.33

Disclosed:

Nov 1, 2025

CVE-2025-11499 on NVD →

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions up to, and including, 1.1.32. This makes it possible for unauthenticat...

CVSS:

9.8

Affected:

up to 1.1.32

Fixed in:

1.3.33

Disclosed:

Oct 31, 2025

CVE-2025-11499 on NVD →

[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4....

Affected:

up to 0.6.7

Fixed in:

0.6.7

Disclosed:

Oct 16, 2024

CVE-2022-4974 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.33.

Affected:

up to 1.0.34

Fixed in:

1.0.34

Disclosed:

Jul 10, 2024

CVE-2024-37498 on NVD →

The Tablesome – Responsive Table, Woocommerce Automation, Email Log, Form Automation – Contact Form 7, Elementor, WPForms, Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.33 due to insufficient capability checks on the get_export_table_props func...

CVSS:

5.3

Affected:

up to 1.0.33

Fixed in:

1.0.34

Disclosed:

Jul 4, 2024

CVE-2024-37498 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Pauple Table & Contact Form 7 Database – Tablesome.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.25.

Affected:

up to 1.0.26

Fixed in:

1.0.26

Disclosed:

Apr 15, 2024

CVE-2024-31388 on NVD →

The Table & Contact Form 7 Database – Tablesome plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.25. This is due to missing or incorrect nonce validation on the publish_table() function. This makes it possible for unauthenticated attackers to publish tables via a fo...

CVSS:

4.3

Affected:

up to 1.0.25

Fixed in:

1.0.26

Disclosed:

Apr 10, 2024

CVE-2024-31388 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pauple Table & Contact Form 7 Database – Tablesome allows Reflected XSS.This issue affects Table & Contact Form 7 Database – Tablesome: from n/a through 1.0.27.

Affected:

up to 1.0.28

Fixed in:

1.0.28

Disclosed:

Mar 19, 2024

CVE-2024-29110 on NVD →

The Table & Contact Form 7 Database – Tablesome plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.0.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that wil...

CVSS:

6.1

Affected:

up to 1.0.27

Fixed in:

1.0.28

Disclosed:

Mar 16, 2024

CVE-2024-29110 on NVD →

The Freemius SDK for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘fs_request_get’ function in versions up to, and including, 2.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute...

CVSS:

6.1

Affected:

up to 1.0.14

Fixed in:

1.0.15

Disclosed:

Jul 18, 2023

CVE-2023-33999 on NVD →

[en] The Tablesome WordPress plugin before 1.0.9 does not escape various generated URLs, before outputting them in attributes when some notices are displayed, leading to Reflected Cross-Site Scripting

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

May 15, 2023

CVE-2023-1890 on NVD →

The Tablesome plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via unescaped URLs in versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

CVSS:

6.1

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Apr 19, 2023

CVE-2023-1890 on NVD →

Update the WordPress Table & Contact Form 7 Database – Tablesome – Data Table & Contact Form 7 Database (CFDB7) Plugin plugin to the latest available version (at least 1.0.9). WordFence discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Table & Contact Form 7 Database – Tablesome – Data...

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Apr 19, 2023

The Tablesome plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via unescaped URLs in versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can...

Affected:

up to 1.0.9

Fixed in:

1.0.9

Disclosed:

Apr 19, 2023

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

CVSS:

6.3

Affected:

up to 0.6.7

Fixed in:

0.6.7

Disclosed:

Mar 4, 2022

CVE-2022-4974 on NVD →

The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. An...

Affected:

up to 0.6.7

Fixed in:

0.6.7

Disclosed:

Mar 4, 2022

Sensitive Information Disclosure vulnerability discovered in WordPress Table & Contact Form 7 Database – Tablesome – Data Table & Contact Form 7 Database (CFDB7) Plugin plugin (versions < 0.6.7).

Affected:

up to 0.6.7

Fixed in:

0.6.7

Disclosed:

Feb 28, 2022

Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Table & Contact Form 7 Database – Tablesome – Data Table & Contact Form 7 Database (CFDB7) Plugin plugin (versions < 0.6.7).

Affected:

up to 0.6.7

Fixed in:

0.6.7

Disclosed:

Feb 28, 2022

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Affected:

up to 1.0.15

Fixed in:

1.0.15

CVE-2023-33999 on NVD →