wpDataTables CVE-2026-66597

The wpDataTables plugin must be installed and active on the target WordPress site, and the affected input or page must be reachable by unauthenticated visitors. No WordPress account or privilege is required on the attacker's part (PR:N confirmed by CVSS). A victim - likely a logged-in WordPress user or administrator - must interact with or visit the page containing the injected payload (UI:R), meaning the attack is not self-propagating and requires a social engineering or watering-hole step. Exploitation is limited to sites with wpDataTables 6.5.1.4 or below; sites that have updated, deactivated, or restricted access to the plugin's front-end pages are not affected.

The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a moderate-to-high real-world risk. The unauthenticated attack vector and low complexity are serious elevating factors, but the mandatory user-interaction requirement (UI:R) reduces immediate exploitability compared to fully self-propagating flaws. The A:L metric in the provided vector is atypical for XSS and should be verified with the vendor, as XSS rarely causes direct server-side availability impact. No EPSS score was provided, and the absence of a KEV listing or known active exploitation suggests opportunistic rather than targeted risk at present. However, WordPress plugins are routinely mass-scanned by threat actors, and the unauthenticated nature makes this a realistic target for automated exploitation campaigns. Sites with wpDataTables installed on publicly accessible pages carry meaningfully higher risk.

An unauthenticated attacker identifies a WordPress site running wpDataTables 6.5.1.4 or earlier and submits a crafted payload (e.g., a script tag or event handler) to the vulnerable input parameter, which is stored or reflected without sanitization. When a logged-in WordPress administrator or authenticated user visits the affected page, the malicious script executes in their browser, allowing the attacker to exfiltrate the session cookie and hijack the admin session. No public proof-of-concept code is confirmed, but the Patchstack disclosure provides sufficient technical detail to enable exploit development.