CVE-2026-6237

Name of the Vulnerable Software and Affected Versions Quick Table versions prior to 1.0.1

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts via the style attribute of the qtbl shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update to a version newer than 1.0.0. As a temporary workaround, restrict the use of the style attribute within the qtbl shortcode.