Description

Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-13T14:17:12.750Z",
  "pubdate": "2026-08-13T14:17:12.750Z",
  "executiveSummary": "An authenticated Cross-Site Scripting (XSS) vulnerability has been identified in the WP Data Access plugin, affecting all versions up to and including 5.5.79. This security flaw enables authenticated users with Author privileges or higher to inject malicious scripts, typically JavaScript, into the application's administrative interface. When viewed by other users, including high-privileged administrators, the injected script executes within the context of their active browser session.\nThe primary impact of this vulnerability includes potential session hijacking, unauthorized administrative actions, defacement, and the exposure of sensitive data managed within the WordPress database. The risk implication is significant as it allows low-privileged administrative actors to escalate their privileges or compromise higher-tier users through stored or reflected malicious payloads.\nExploitation requires the attacker to possess authenticated access with at least Author-level privileges within the vulnerable WordPress installation. No complex interaction beyond standard administrative navigation or viewing of crafted data parameters is required for successful payload execution.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of the WP Data Access plugin for WordPress, specifically impacting versions 5.5.79 and prior. The root cause stems from insufficient input sanitization and inadequate contextual output encoding of user-supplied data before it is reflected back to the browser or stored within the application state.\nThe affected component handles data processing within administrative modules accessible to users with Author privileges. Due to the lack of strict input filtering and output escaping routines, an attacker can supply specially crafted payloads containing HTML markup and JavaScript event handlers.\nThe step-by-step attack flow proceeds as follows: First, the authenticated attacker with Author privileges crafts an HTTP request containing a malicious payload targeting vulnerable input vectors within the plugin's interface. Second, the application processes the input and improperly sanitizes the data, committing it to storage or reflecting it directly in the Document Object Model (DOM) without proper neutralization. Third, when a victim—potentially an administrator—navigates to the compromised section of the plugin interface, the application renders the raw payload. Fourth, the victim's browser parses the injected script within the active session context, executing the arbitrary JavaScript code.\nThe exploitation method leverages the trust relationship between the user's browser and the WordPress application. Because the script executes in the security context of the victim, it can access Document properties, perform unauthorized AJAX requests on behalf of the user, read session cookies, and interact with the WordPress REST API or admin-ajax.php endpoints.\nAuthentication is strictly required, bounded by the Author privilege tier. The network exposure is restricted to the administrative interface of the WordPress deployment. Post-exploitation impact encompasses full administrative account takeover, arbitrary database manipulation via plugin features, and potential pivoting to broader server-side execution if combined with other vulnerabilities."
}