What is the CVSS score of CVE-2026-65509?

CVE-2026-65509 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of wpDataTables are affected by CVE-2026-65509?

The wpDataTables WordPress plugin (versions 7.5.1 and earlier) contains an unauthenticated cross-site scripting flaw that allows attackers to execute arbitrary actions within the browsers of…

How to fix or mitigate CVE-2026-65509?

Within 24 hours, inventory all WordPress installations using wpDataTables to identify affected versions (7.5.1 and earlier) and document public exposure. Within 7 days, implement compensating controls: deploy Web Application Firewall rules to block XSS payloads targeting the plugin, restrict plugin access to authenticated users only, disable public-facing table inputs where business functionality permits, and enable two-factor authentication on all administrative accounts. Within 30 days, evaluate alternative plugins or request an urgent security patch from the vendor; establish a third-party plugin vulnerability monitoring process to reduce mean-time-to-response for future advisories.

wpDataTables CVE-2026-65509

EUVD-2026-53965 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-vwpv-7mgc-gcvr

WordPress XSS Wpdatatables Wordpress Plugin

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Standard reflected/stored XSS: network vector, no auth, victim interaction required, scope changes to browser; availability impact not substantiated for typical XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:27 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

AnalysisAI

Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - XSS) identifies the root cause: user-supplied input is rendered in an HTML context without adequate sanitization or escaping. The affected product, identified via CPE cpe:2.3:a:wpdatatables:wpdatatables:*:*:*:*:*:*:*:*, is the wpDataTables WordPress plugin - a premium plugin for rendering interactive data tables and charts from spreadsheets and databases. The CVSS scope-change metric (S:C) is characteristic of stored or reflected XSS where the execution context shifts from the server-side component to the victim's browser session, a different security principal. The combination of AV:N and PR:N confirms that the injection point is reachable by unauthenticated, external HTTP clients.

RemediationAI

The primary remediation is to update the wpDataTables plugin beyond version 7.5.1. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-7-5-1-cross-site-scripting-xss-vulnerability should be consulted for the exact patched version, as an explicit fix version number was not present in the available intelligence data. If an immediate update is not possible, administrators should restrict public access to any pages or endpoints that render wpDataTables table content with user-supplied parameters - for example, placing affected pages behind authentication or a WAF rule targeting common XSS patterns in table query strings. WordPress sites should also enforce a strict Content Security Policy (CSP) header to limit the impact of any successful XSS injection by blocking inline script execution and restricting allowed script sources. Note that CSP configuration may require tuning and could break other plugin functionality if not carefully scoped.