Skip to main content

wpDataTables CVE-2026-66597

| EUVDEUVD-2026-63339 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-08-20 Patchstack GHSA-j4rj-3wf9-w52j
WordPress XSS Wpdatatables Wordpress Plugin Melograno Venture Studio
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
6.1 MEDIUM

AV:N/AC:L/PR:N reflect unauthenticated network exploitation; UI:R because victim must load the page; S:C for browser context escape; A:N as XSS does not directly impact server availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Aug 20, 2026 - 12:37 vuln.today
CVE Published
Aug 20, 2026 - 12:07 cve.org
HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

AnalysisAI

Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The wpDataTables plugin must be installed and active on the target WordPress site, and the affected input or page must be reachable by unauthenticated visitors. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a moderate-to-high real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is to update wpDataTables to a version above 6.5.1.4 via the WordPress plugin repository; the exact patched release version is not independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-5-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve for the confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit all WordPress instances for wpDataTables 6.5.1.4 or earlier and immediately disable the plugin; preserve all server and WordPress logs for forensic review. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Wpdatatables

View all
CVE-2021-26754 CRITICAL POC
9.8 Feb 08

wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order
CVE-2014-9175 HIGH POC
7.5 Dec 02

SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote
CVE-2023-4314 HIGH POC
7.2 Sep 11

The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deseriali
CVE-2026-49080 CRITICAL
9.3 Jun 16

SQL injection in the wpDataTables WordPress plugin versions 7.3.6 and earlier allows unauthenticated remote attackers to
CVE-2021-24198 HIGH
8.1 Apr 12

The wpDataTables - Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. Rated high s
CVE-2021-24197 HIGH
8.1 Apr 12

The wpDataTables - Tables & Table Charts premium WordPress plugin before 3.4.2 has Improper Access Control. Rated high s
CVE-2026-65509 HIGH
7.1 Aug 06

Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote
CVE-2026-57672 HIGH
7.1 Jul 02

Reflected/stored cross-site scripting in the wpDataTables WordPress plugin (versions 6.5.1.1 and earlier) allows unauthe
CVE-2021-24200 MEDIUM
6.5 Apr 12

The wpDataTables - Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user
CVE-2021-24199 MEDIUM
6.5 Apr 12

The wpDataTables - Tables & Table Charts premium WordPress plugin before 3.4.2 allows a low privilege authenticated user
CVE-2024-0591 MEDIUM
6.1 Mar 13

The wpDataTables - WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Refl
CVE-2023-23876 MEDIUM
5.4 May 03

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-66597 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy