What is the CVSS score of CVE-2026-57672?

CVE-2026-57672 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of wpDataTables are affected by CVE-2026-57672?

wpDataTables WordPress plugin versions 6.5.1.1 and earlier contain a reflected/stored XSS vulnerability exploitable by unauthenticated attackers, enabling injection of malicious code that can…

How to fix or mitigate CVE-2026-57672?

Within 24 hours: Audit all WordPress installations for wpDataTables ≤6.5.1.1; immediately disable or uninstall the plugin until a vendor patch is released. Within 7 days: Review WordPress user audit logs and active sessions for unauthorized access; force password reset for all administrative and privileged accounts; revoke active sessions. Within 30 days: Monitor Patchstack and wpDataTables official channels for patch release; test patch thoroughly in non-production environment before deployment; alternatively evaluate and migrate to alternative table-rendering plugins with documented security practices.

wpDataTables CVE-2026-57672

EUVD-2026-41283 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-wh3h-pj4h-37rg

WordPress XSS Wpdatatables Wordpress Plugin Melograno Venture Studio

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS (AV:N/PR:N) requiring victim interaction (UI:R), with scope change into the site context (S:C) and limited browser-side C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:19 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

AnalysisAI

Reflected/stored cross-site scripting in the wpDataTables WordPress plugin (versions 6.5.1.1 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they view a crafted page or follow a malicious link. The scope-change (S:C) rating in the CVSS vector indicates the injected script can affect resources beyond the vulnerable component - for example the wider WordPress site context - enabling session/cookie theft or admin-panel actions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed through Patchstack's vulnerability database.

Technical ContextAI

wpDataTables is a commercial WordPress table/chart-building plugin (vendor CPE: melograno_venture_studio:wpdatatables) used to render sortable, filterable data tables and charts on WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controllable input is reflected or stored into HTML output without adequate output encoding or input sanitization, so browser-interpreted markup and script survive into the rendered page. Because the entry point is reachable without authentication (PR:N), the untrusted data path is exposed to anonymous visitors rather than requiring a logged-in role.

RemediationAI

No exact vendor fix version is stated in the available data, so the specific patched release is not independently confirmed; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-5-1-1-cross-site-scripting-xss-vulnerability) and the plugin's changelog and upgrade to the first release above 6.5.1.1 as soon as the vendor publishes it. Until a patched version is confirmed and applied, reduce exposure by placing the affected plugin endpoints behind a Web Application Firewall with XSS filtering rules (Patchstack itself offers virtual patching for this CVE), restricting or gating public access to pages that render wpDataTables output, and enabling a strict Content-Security-Policy that disallows inline script to blunt injected payloads - note that a strict CSP can break legitimate inline scripts used by themes/plugins and should be tested in staging. If the plugin is not actively needed, deactivating and removing it eliminates the exposure entirely at the cost of losing table/chart functionality.