CVE-2026-118189

Name of the Vulnerable Software and Affected Versions Posts Table with Search & Sort versions prior to 1.4.15

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By manipulating the date format parameter, an attacker can inject arbitrary web scripts into pages. The attack bypasses the wp kses post function during the saving process because the payload avoids using literal angle bracket characters, reconstructing the malicious HTML tags only during rendering. This allows users without the unfiltered html capability to execute scripts when other users access the affected page.

Recommendations Update the plugin to version 1.4.15 or later. Restrict access to the date format parameter for users with contributor-level permissions until the update is applied.