---
title: "TablePress"
description: "TablePress free or Pro: strengths, limitations, pricing, recommended settings for readable, fast tables, and the patched vulnerabilities to know about."
language: "en"
locale: "en-US"
type: "plugin-sheet"
canonical: "https://www.wp-masquerade.com/features/camouflaged-plugins/tablepress/"
published: "2026-11-04T08:00:00+00:00"
modified: "2026-11-05T21:26:15+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/features/camouflaged-plugins/tablepress/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/tablepress/index.md"
  es-ES: "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/tablepress/index.md"
  de-DE: "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/tablepress/index.md"
  it-IT: "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/tablepress/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/tablepress/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/tablepress/index.md"
---

# TablePress

TablePress builds sortable, searchable tables in WordPress, imported from Excel or Google Sheets, without writing code. Our take on the free version and the Pro and Max plans, the per-table settings worth adjusting and the patched vulnerabilities to know about.

## The essentials

- Best for sortable price lists, timetables or directories built from a spreadsheet, with no code.
- Main caveat: phone-friendly layouts and fixed columns require a paid plan.
- Free; Pro costs €89 per year for one site plus tax, Max €189 with automatic syncing.

## What TablePress does in WordPress

TablePress adds a “TablePress” menu to the dashboard, with All Tables, Add New Table, Import, Export and Plugin Options screens. You fill in each table in a spreadsheet-style editor: cell-by-cell entry, links, images, merged cells and math formulas. Since version 3.4, a sticky toolbar keeps every editing command in reach, including undo and redo. Tables are stored as JSON in the WordPress database, as a `tablepress_table` post type.

To display one, you add the “TablePress table” block in the block editor, the dedicated widget in [Elementor](https://www.wp-masquerade.com/features/camouflaged-plugins/elementor/), or the `[table id=1 /]` shortcode in other page builders. On the front end, the DataTables JavaScript library, which relies on jQuery, adds column sorting, search, pagination and an info line. The stylesheet only loads on pages that show a table, and each table’s HTML is cached for 24 hours for logged-out visitors.

The plugin is developed by Tobias Bäthge and free on wordpress.org. The paid plans, sold on tablepress.org with Freemius as the reseller, install as a separate plugin that replaces the free version; your tables and settings carry over.

![Diagram: TablePress works on visitors and bots, wordpress, database and files. Public traces: signed HTML comments (hidden with Pro); folder name (hidden with Pro); tag IDs (hidden with Pro); CSS classes (still visible).](https://www.wp-masquerade.com/media/wpm-sheets/tablepress/diagram-en.svg?v=c0e6d34e)

## Which sites TablePress suits best

TablePress is built for publishing data in rows and columns and keeping it current without code. It fits well for:

- **Price lists, timetables and schedules**: a club, a school or a contractor updates one table, and every page that shows it changes at once.
- **Directories, inventories and member lists**: built-in search and sorting are enough to find one row among hundreds.
- **Product or model comparison tables**: the content stays real HTML, readable by search engines and screen readers.
- **Data kept in a spreadsheet**: import from an Excel, CSV, HTML or JSON file, or from a URL, including Google Sheets, Excel Online, Dropbox and OneDrive.

It is the wrong tool for a WooCommerce catalog with buy buttons, for charts, or for a very wide table that has to stay comfortable on phones without paying: the small-screen layouts belong to the Pro and Max plans.

## TablePress strengths and limitations

### Strengths

- **A free version with no caps.** Unlimited tables and no size limits, according to the developer.
- **One table, many pages.** The same table goes anywhere through a block, an Elementor widget or a shortcode, and you edit it in one place.
- **Full import and export.** Excel, CSV, HTML and JSON both ways, plus import from a URL or an online spreadsheet.
- **Accessible HTML tables.** Content is indexable, and sorting, search and pagination include enhancements for assistive technologies.

### Limitations

- **Mobile layouts and fixed columns cost extra.** Responsive tables and fixed rows or columns need TablePress Pro; the free version only offers horizontal scrolling.
- **No automatic sync in the free version.** A Google Sheets import is one-off; periodic updates from a source are a Max feature.
- **Limited merged cells.** With sorting, search and pagination on, merged cells are only allowed in header and footer rows.
- **jQuery for interactivity.** Visitor features rely on DataTables and jQuery, loaded on the pages that need them.
- **Large datasets: server-side processing in Max.** Server-side sorting, filtering and pagination, designed to load big tables fast, require Max.

## The TablePress settings we recommend

Most options are set per table, on the Edit screen. The labels below match the plugin’s English interface.

| Setting | Recommended value | Why |
| --- | --- | --- |
| **Enable Visitor Features**  TablePress > Edit > Table Features for Site Visitors | On for long tables only | It is on by default and loads DataTables and jQuery; a table with a few rows needs neither sorting nor search. |
| **Table Header** (first row as header) TablePress > Edit > Table Options | 1 (default) | The first row becomes a real column header, which helps screen readers and is required for sorting. |
| **Pagination** and **Pagination Length Change**  Same screen, Table Features for Site Visitors | On, 10 rows per page to start | Short pages read better, and visitors can show more rows if they want. |
| **Horizontal Scrolling**  Same screen | On for tables with more than five or six columns | Off by default; it is the free way to keep a wide table readable on phones. |
| **Custom Commands**  Same screen | Empty unless you need something specific | This field passes JavaScript parameters to DataTables; a syntax error can break the table display. |
| **Custom CSS**  TablePress > Plugin Options | On if you have styles to add | Your styles survive updates, unlike edits to the plugin’s own files. |

- Open a page with a table in a private window and on a phone: sorting, search and scrolling should all work.
- Export your tables as JSON from TablePress > Export on a regular basis: the plugin itself recommends this backup.
- Never click “Uninstall TablePress” in Plugin Options without that export: the button permanently deletes every table from the database.
- Check who can create tables: by default, authors, editors and administrators; importing from a URL is limited to editors and administrators.

## TablePress security: XSS flaws, patched quickly

Most published vulnerabilities are XSS flaws, usually exploitable with a contributor or author account. When a user lacks the `unfiltered_html` capability, TablePress sanitizes cell content on save, which reduces that risk on sites with several writers. The recent cases worth knowing:

- **CVE-2026-56051, fixed in 3.3.2**: reflected XSS exploitable without an account, through a booby-trapped link a user clicks (CVSS 7.1 according to Patchstack).
- **CVE-2025-12324, fixed in 3.2.5**: stored XSS through the `[table]` shortcode attributes, with a contributor account.
- **CVE-2025-9500, fixed in 3.2.1**: stored XSS through the `shortcode_debug` parameter, with a contributor account.
- **CVE-2025-5096, fixed in 3.1.3**: DOM-based stored XSS through several `data-` attributes, with a contributor account.
- **CVE-2024-23825, fixed in 2.2.5**: import from a URL filtered destinations poorly, which allowed [server-side request forgery](https://www.wp-masquerade.com/glossary/ssrf/).

The developer uses Patchstack’s disclosure program, and fixes ship in maintenance releases: turn on automatic plugin updates for TablePress. With an expired Premium license, the paid plugin no longer gets updates, security fixes included, so renew it or switch back to the free version. TablePress also marks tables served from its cache with an HTML comment; WP Masquerade Pro removes it, which makes bot fingerprinting harder without replacing updates.

## TablePress FAQ

**Is the free version of TablePress enough?**

For price lists, timetables or a directory, yes: unlimited tables, import, export, sorting, search and pagination are free. Pro makes sense if your tables must adapt to phones or keep a fixed header, Max if you want automatic syncing or very large tables.

**How much do TablePress Pro and Max cost?**

The official pricing page lists €89 per year for Pro and €189 per year for Max, plus tax, for one site. Lifetime licenses and 5, 25 or 100-site bundles are available, and staging or test sites are included.

**Can a table stay in sync with Google Sheets?**

The free version imports a table from Google Sheets by its URL, but only once: you rerun the import after every change. Automatic periodic updates are part of TablePress Max.

**What happens to my tables if the Premium license expires?**

Your tables and data stay in place, but Premium features stop applying and the plugin no longer gets updates. You can then reinstall the free version to keep receiving fixes.

## Key facts

- Category: Utilities
- Vendor: Tobias Bäthge (TablePress)
- Price: Free; TablePress Pro at €89 per year and Max at €189 per year for one site, plus tax
- Active installations (wordpress.org): 600 000+
- Version: 3.4.1
- Official page: https://wordpress.org/plugins/tablepress/

## What WP Masquerade hides

- Handled by WP Masquerade Pro only
- With Pro: signed HTML comments, folder name, tag IDs
- Still visible: CSS classes