What is the CVSS score of CVE-2026-5721?

CVE-2026-5721 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-5721

EUVD-2026-23981 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-20 Wordfence

XSS WordPress

4.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.7 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 20, 2026 - 23:51 vuln.today

EUVD ID Assigned

Apr 20, 2026 - 23:15 euvd

EUVD-2026-23981

Analysis Generated

Apr 20, 2026 - 23:15 vuln.today

CVE Published

Apr 20, 2026 - 22:25 nvd

MEDIUM 4.7

DescriptionCVE.org

The wpDataTables - WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.5.0.4. This is due to insufficient input sanitization and output escaping in the prepareCellOutput() method of the LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, given that they can trick an Administrator into importing data from an attacker-controlled source and the affected column types (Link, Image, or Email) are configured.

AnalysisAI

Stored Cross-Site Scripting in wpDataTables WordPress plugin (all versions up to 6.5.0.4) allows unauthenticated attackers to inject malicious scripts into data tables via insufficient input sanitization in LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. Exploitation requires an Administrator to import attacker-controlled data with affected column types configured, but once injected, the malicious script executes for all users viewing the infected page. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

The vulnerability resides in the prepareCellOutput() method across three column handler classes in the wpDataTables plugin, which processes user-supplied data for display in WordPress table elements. The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) stems from the plugin's failure to properly sanitize data during import and escape output when rendering table cells. The affected column types-Link, Image, and Email-are high-risk because they permit user-controlled HTML/URL content. The vulnerability is stored, meaning the malicious payload persists in the WordPress database after import, ensuring execution on every page view rather than requiring per-request injection. This affects all installations using the free plugin from the WordPress Plugin Directory (CPE identifier: cpe:2.3:a:wpdatatables:wpdatatables_-_wordpress_data_table,_dynamic_tables_&_table_charts_plugin).

RemediationAI

Immediately update wpDataTables to version 6.5.0.5 or later, which contains input sanitization and output escaping fixes in the prepareCellOutput() method. Update via WordPress dashboard (Plugins > Installed Plugins > wpDataTables > Update) or manually download from https://plugins.wordpress.org/wpdatatables/. As an interim measure pending patch deployment, disable import functionality for non-trusted administrators via WordPress user role restrictions (edit wp-capabilities or use a role management plugin to revoke the manage_wdt_core_data capability from non-trusted editors/administrators). Additionally, review existing data tables and audit imported data sources; if data was imported from untrusted sources prior to patching, export data to CSV, deactivate the plugin, purge the database of infected tables, then re-import only from verified sources after updating. Restrict access to the table import interface to trusted Administrators only. Do not rely on these compensating controls long-term; patch application is mandatory.