Cross-site Scripting in tableexport.jquery.plugin

MEDIUM 5.4CVE-2022-1291 · GHSA-j636-crp3-m584 · Published 10/04/2022 · updated 17/06/2026

In short

CVE-2022-1291 is a MEDIUM (CVSS 5.4) vulnerability affecting tableexport.jquery.plugin (tableexport.jquery.plugin project), tableexport.jquery.plugin.
Chance of exploitation in the next 30 days (EPSS): 0.73%, higher than 54.7% of all vulnerabilities.
Fix: update to 1.25.0 or later.

Package	Affected versions	Patched versions
tableexport.jquery.plugin tableexport.jquery.plugin_project	`< 1.25.0`	`1.25.0`
tableexport.jquery.plugin npm	`< 1.25.0`	`1.25.0`

Description

There is a cross-site scripting vulnerability with default onCellHtmlData function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.

NVD description

XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers

References

nvd.nist.gov/vuln/detail/CVE-2022-1291 · ADVISORY
hhurz/tableexport.jquery.plugin commit dcbaee2 · WEB
hhurz/tableexport.jquery.plugin · PACKAGE
huntr.dev/bounties/49a14371-6058-47dd-9801-ec38a7459fc5 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free