Hello,

Plugin: Websimon Tables 1.3.4 https://wordpress.org/plugins/websimon-tables/

1. Reflected Cross-Site Scripting (XSS)

Authenticated administrators can inject html/js code (there is no CSRF protection).

Method: GET

Url: http://localhost/wp-admin/tools.php?page=websimon_tables&action=edit_style&id=[xss]

Vulnerable parameters: id

Example PHP callstack:

/websimon-tables/php/basic.php:98

Verification:

Same XSSs are in:

/websimon-tables/php/edit_table.php:52

/websimon-tables/php/advanced.php:42