Data Tables Generator by Supsystic EUVD-2026-96111

Requires an authenticated account with contributor-level privileges or higher on the target WordPress site, and the site must have the Data Tables Generator by Supsystic plugin (version 1.12.03 or earlier) installed and in use. Exploitation depends on the attacker being able to create or edit table content containing the 'id' attribute, and on a victim user subsequently viewing the page where the injected table renders - so sites that do not allow untrusted users to hold contributor accounts are substantially less exposed. No non-default plugin configuration is required beyond normal use of the table-generation feature.

This is a medium-severity stored XSS (CVSS 6.4) that should be treated as a routine, patch-on-schedule issue rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) shows network-reachable, low-complexity exploitation but requires authenticated access at contributor level (PR:L), which materially limits the attacker population to users who already hold an account on the site. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input; there is therefore no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) and stored nature mean an injected script executes against other users (including higher-privileged admins) who view the affected page, which is the main escalation concern. Net assessment: a genuine but lower-tier priority - real because it enables privilege escalation via admin session compromise, but gated behind requiring an existing contributor account and targeting sites that permit untrusted contributor registration.

An attacker who holds (or registers for) a contributor-level account on a WordPress site running this plugin creates or edits a data table and injects a malicious script via the unsanitized 'id' attribute. When an administrator or other user later views the page rendering that table, the stored script executes in their browser session, potentially stealing session cookies or performing admin actions. No public exploit code was identified in the provided data.