Description

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:15.097Z",
  "pubdate": "2026-08-06T15:17:15.097Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the wpDataTables plugin, specifically affecting versions 7.5.1 and prior.\nThis vulnerability allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered by the affected software.\nWhen a legitimate user views the compromised page, the injected payload executes within the context of their browser session.\nThe primary impact of this security flaw includes session hijacking, unauthorized access to sensitive application data, redirection to malicious destinations, and defacement of the affected website.\nThe risk implication is critical due to the lack of authentication requirements, enabling drive-by exploitation against visitors and administrators alike.\nSuccessful exploitation requires the victim to interact with or load the vulnerable component containing the un sanitized input rendered by the plugin.\nSystem administrators operating vulnerable instances face severe integrity and confidentiality risks until remediation is applied.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the wpDataTables plugin for WordPress, impacting all versions up to and including version 7.5.1.\nThe root cause stems from insufficient validation and improper neutralization of user-supplied input before it is reflected back to the client within the Hypertext Markup Language (HTML) document.\nBecause the vulnerability is unauthenticated, an external attacker does not require valid credentials or administrative privileges to interact with the vulnerable endpoint.\nThe attack vector is network-based, allowing malicious payloads to be submitted via HTTP requests where input parameters are improperly processed and stored or reflected by the application.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags. Second, the attacker transmits this payload to the vulnerable wpDataTables endpoint without authentication. Third, the application fails to sanitize the input correctly and includes it in the HTTP response generated for users. Finally, when a victim's browser parses the response, the injected script executes in the context of the victim's session.\nPayload behavior involves executing arbitrary JavaScript in the Document Object Model (DOM) of the victim's browser, enabling actions such as stealing session cookies, capturing keystrokes, or performing unauthorized state-changing operations on behalf of the user.\nPost-exploitation impact depends on the privilege level of the victim viewing the payload; if an administrative user falls victim to the execution, the attacker may achieve full administrative compromise of the underlying WordPress installation."
}