wpDataTables EUVD-2026-41283

Exploitation requires that the wpDataTables plugin (version 6.5.1.1 or earlier) is installed and that the vulnerable input-reflecting path is publicly reachable - no authentication is needed (PR:N), consistent with the "unauthenticated XSS" disclosure. The key limiting factor is required user interaction (UI:R): a victim must open an attacker-crafted link or view attacker-influenced content for the injected script to fire, so exploitation depends on successful social engineering or luring rather than a purely automated remote hit. Impact is amplified by the scope change (S:C), meaning the payload's effect can extend beyond the plugin into the wider WordPress site context, but the payload only executes in the browser of a user who is induced to load the malicious content.

The CVSS 3.1 base score is 7.1 (High) driven by AV:N/AC:L/PR:N/UI:R with a scope change (S:C) and Low impact across confidentiality, integrity, and availability. The network vector, low complexity, and no-privilege requirement make it easy to reach, but the UI:R requirement means a victim must be induced to interact (open a link or view attacker-influenced content), which meaningfully reduces automatability and mass-exploitation likelihood - this is a phishing/social-engineering-gated bug rather than a wormable one. No EPSS score was provided in the input, and there is no KEV listing or POC signal, so real-world exploitation pressure appears currently low-to-moderate and opportunistic. The scope change is the aggravating factor: successful injection can pivot into the broader site/admin context, so on WordPress sites that run this plugin publicly it should be treated as a genuine priority rather than a paper-only high.

An attacker crafts a URL or submits input to a wpDataTables-rendered page containing a malicious script payload, then lures a site visitor or administrator to open it (UI:R). When the victim's browser renders the unsanitized output, the script runs in the site's origin and, given the scope change, can steal session cookies, perform actions as the victim, or attempt admin-panel takeover. No public proof-of-concept is identified at this time.