Table Manager
Table Manager has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).
The one issue recorded for Table Manager has a vendor fix available, so running the current release closes it.
All of these findings were reported by Itthidej Aramsri (Boeing777). Table Manager is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.7.
CVE-2026-4126Table Manager <= 1.0.0 - Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute
Read the full analysisVulnerability Records
Table Manager
Author
primisdigital
The “Table Manager” plugin for WordPress allows users to create, manage and display tables easily using a shortcode. It enables creating tables, adding and updating columns, and managing data (insert, update, delete). Each table generates a unique shortcode for displaying content on posts or pages. The plugin also provides secure form handling, an easy-to-use admin interface, and custom CSS/JS for table display on the front end. Features Create and manage custom tables from the WordPress admin panel. Add, delete, and update table columns dynamically. Insert and update table data through an easy-to-use interface. The Display tables using a simple shortcode. The Secure and optimized queries using WordPress best practices. Admin Installer via search: Visit the Add New plugin screen and search for “Table Manager”. Click the “Install Now” button. Activate the plugin. Admin Installer via zip: Download the Plugin. Extract the ZIP file and upload. Activate the plugin through the “Plugins” menu in WordPress. Usage Creating a New Table Navigate to Table Manager in the WordPress admin panel. Click on “Create Table” and enter the table name. Add columns as needed and save the table. Managing Table Data Select a table from the dropdown menu. Insert new records using the input form. Delete or update records directly from the interface. Displaying Tables on the Frontend Use the following shortcode in posts or pages to display a table: [display_table name=”your_table_name”] Security Best Practices Admin Capability Check: Access is restricted to administrators using manage_options capability. SQL Injection Prevention: Queries are secured with WordPress $wpdb->prepare() where applicable. Input Sanitization: All user inputs are sanitized before being inserted into the database. Code Example Registering Admin Menu: function form_datamenu() { add_menu_page( ‘Table Manager’, ‘Table Manager’, ‘manage_options’, ‘form_datamenu’, ‘form_data_adminpage’, ‘dashicons-database’, 20 ); } add_action(‘admin_menu’, ‘form_datamenu’);
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C