Data Tables Generator By Supsystic
Monthly
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.
Stored cross-site scripting in the Data Tables Generator by Supsystic WordPress plugin (all versions up to and including 1.12.03) allows an authenticated attacker holding contributor-level access or higher to inject arbitrary script into a table's id attribute, which is then stored and executed in the browser of any user - including an administrator - who views the affected page. The issue is rated CVSS 6.4 with a scope change (S:C) because the injected script executes in the security context of the hosting site rather than merely the plugin, giving the attacker a path to session theft, content tampering, or administrative action on behalf of the victim. No public exploit code and no confirmed active exploitation were identified at time of analysis, and an upstream fix has been committed to the plugin repository (changeset 3608322).
Stored cross-site scripting in the WordPress plugin Data Tables Generator by Supsystic (all versions up to and including 1.15.1) allows an authenticated attacker holding a Subscriber-level or higher account to inject arbitrary JavaScript into a table cell's 'data' value through the updateRows action, which then executes in the browser of any user who views a page rendering that table. Reachability depends on a non-default precondition: an administrator must have deliberately added the attacker's low-privilege role to the plugin's 'access_roles' setting, which is a documented feature that hands those users the dtgs_nonce needed to call the vulnerable handler, so the exploitable population is meaningfully narrower than the raw base vector implies. No public exploit code has been identified at time of analysis and there is no KEV listing.