Data Tables Generator CVE-2026-96648

Exploitable only when an administrator has added the attacker's role (Subscriber) to the plugin's 'access_roles' setting - a documented, explicitly supported feature that grants lower-privileged users the dtgs_nonce required to reach the updateRows action handler. The attacker must hold an authenticated Subscriber-level (or higher) account on the target site. LIMITING FACTORS: this is NOT a default configuration (access_roles must be deliberately extended to low-privilege roles by an admin), exploitation requires valid authentication, and payload execution requires a victim to access a page that renders the injected table. These conditions meaningfully narrow the exploitable population versus the AV:N/PR:L base vector.

This is a moderate-severity Stored XSS (CWE-79, CVSS 6.4) whose real-world risk is substantially constrained by a precondition that the raw CVSS vector understates. The input CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates network-reachable, low-privilege, no-user-interaction exploitation with a scope change - typical of a self-executing stored XSS. However, the description makes clear exploitation is NOT possible in a default configuration: a Subscriber can only reach the vulnerable updateRows handler if an administrator has explicitly added the Subscriber role to the plugin's 'access_roles' setting to obtain the dtgs_nonce. This is a legitimate, documented feature, but it is a non-default condition, so AC:L arguably understates complexity. No EPSS score, KEV listing, or public POC was provided in the intelligence; with no public exploit identified at time of analysis and no evidence of active exploitation, this is a prioritize-for-patch-cycle issue rather than an emergency. Net: a genuine authenticated stored XSS confirmed by Wordfence, but the 'PR:L + UI:N' framing overstates ease - effective exploitation depends on a deliberate administrator configuration choice, pushing actual risk below what the 6.4 base score alone suggests.

On a site where an administrator has added the Subscriber role to the Data Tables Generator 'access_roles' setting, a malicious Subscriber-level user uses their granted dtgs_nonce to call the updateRows action and injects a JavaScript payload into a table cell's 'data' value. The payload is stored and then executes in the browser of any user - including higher-privileged administrators - who views a page rendering that table, enabling session/cookie theft or admin-context actions. No public exploit code was identified at time of analysis, though the vulnerable code paths are documented in the referenced plugin source.