Description

Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-20T12:16:33.557Z",
  "pubdate": "2026-08-20T12:16:33.557Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the wpDataTables plugin, specifically affecting versions 6.5.1.4 and prior. This security flaw enables remote, unauthenticated threat actors to inject malicious JavaScript payloads into vulnerable input parameters handled by the application. The primary impact of this vulnerability includes the potential execution of arbitrary client-side scripts within the context of a victim's browser session, session hijacking, credential theft, and unauthorized manipulation of the Document Object Model (DOM) upon successful interaction with the crafted malicious link. The affected system comprises WordPress environments utilizing vulnerable installations of the wpDataTables plugin. Risk implications are elevated due to the lack of authentication requirements, allowing any external attacker to target administrative or standard users who interact with the rendered output. Exploitation requires the victim to access a specially crafted URL or resource containing the malicious payload, leveraging the implicit trust the browser places in the application response.",
  "technicalDetails": "The vulnerability stems from improper input sanitization and output encoding within the wpDataTables plugin for WordPress. Specifically, user-supplied parameters are processed and subsequently reflected back into the HTTP response without undergoing rigorous contextual neutralization, violating secure coding principles regarding untrusted data handling. The vulnerable component resides within the request handling and rendering pipeline of the wpDataTables plugin affecting versions <= 6.5.1.4. Because the vulnerability is unauthenticated, no prior session, credentials, or privilege levels are required to initiate the attack vector. Network exposure is broad, as the application interface is accessible over standard HTTP/HTTPS protocols to any external entity interacting with the web server. The attack flow commences when an unauthenticated adversary crafts a malicious Uniform Resource Locator (URL) containing an arbitrary JavaScript payload injected into a vulnerable parameter handled by the plugin. The attacker then induces a target user—such as an authenticated site administrator or privileged operator—to visit the crafted hyperlink via social engineering, phishing, or automated delivery mechanisms. Upon receipt of the request, the vulnerable server processes the input and includes the unescaped payload within the generated HTML response document. When the victim's browser parses the incoming response, it fails to distinguish between legitimate application code and the injected script, leading directly to execution within the security context of the victim's session. The behavior of the payload can range from simple session token exfiltration via document.cookie access to complex DOM-based actions, potentially resulting in unauthorized administrative actions, privilege escalation within the application, or further system compromise depending on the privileges of the targeted user session."
}