wpDataTables CVE-2026-65509

The attacker requires no authentication against the WordPress site (PR:N confirmed by CVSS vector). Exploitation requires that a victim user - most likely a WordPress administrator or editor - visits or is directed to a page rendering the malicious wpDataTables content (UI:R). The specific wpDataTables input field or parameter accepting unsanitized user data is not identified in the available intelligence; the Patchstack advisory should be reviewed to identify the precise injection point. Exploitation is limited by the requirement for victim interaction: a purely server-side or automated attack chain is not feasible. Sites where wpDataTables pages are only accessible to authenticated users have a reduced attack surface, as an unauthenticated attacker would still need a logged-in victim to complete the XSS chain.

The CVSS base score of 7.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L reflects a medium-high risk profile. PR:N confirms exploitation does not require an attacker to hold any WordPress account, significantly lowering the barrier to entry. AC:L indicates no special timing, race condition, or complex prerequisite is needed. UI:R is the primary limiting factor - a victim (typically a logged-in administrator or editor) must visit or be lured to the page containing the injected payload. The scope change (S:C) elevates practical impact because a successful attack against an admin session can result in site takeover, not merely content defacement. No EPSS data was provided in the intelligence set, and the CVE does not appear in the CISA KEV catalog, so widespread in-the-wild exploitation is not confirmed. The vendor-assigned A:L for availability is notable - standard reflected XSS rarely causes availability impact, and this metric warrants independent verification by operators. The overall risk is real and actionable, particularly for sites where unauthenticated users can interact with wpDataTables-rendered content.

An attacker identifies a wpDataTables-powered page on a target WordPress site that reflects or stores user-supplied input without sanitization. The attacker crafts a malicious URL or form submission containing a JavaScript payload and either visits the page directly (reflected XSS) or submits the payload for storage. The attacker then socially engineers a logged-in WordPress administrator into clicking a crafted link, causing the malicious script to execute in the admin's browser, where it can exfiltrate session cookies, create rogue admin accounts via the WordPress REST API, or perform any action the admin user can perform. No public proof-of-concept code has been identified at the time of analysis, but the low attack complexity makes independent exploitation straightforward for a moderately skilled attacker.