CVE-2026-14877 in Data Tables Generator Plugin
Summary
by MITRE • 10/10/2026
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The Data Tables Generator plugin by Supsystic represents a widely utilized tool within the WordPress ecosystem, designed to facilitate the creation of dynamic data tables for website content. However, security audits have identified a critical vulnerability affecting all versions up through 1.12.03. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, which arises from insufficient input sanitization and output escaping mechanisms within the plugin's codebase. Specifically, the vulnerability resides in how the application handles the id attribute associated with data table configurations. When an administrator or user with elevated privileges submits form data to create or modify a data table, the system fails to adequately validate or escape special characters present in the identifier field before storing it in the database and subsequently rendering it on public-facing pages.
The technical nature of this flaw allows authenticated attackers who possess contributor-level access or higher to inject arbitrary web scripts into the application's stored content. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, stored XSS persists within the target server's memory or database. Consequently, when any other user visits a page containing the compromised data table, the browser parses and executes the injected script in the context of the victim's session with the website. This persistence transforms the vulnerability from a transient risk into a long-term threat vector that can compromise multiple users over an extended period without further interaction from the attacker.
The operational impact of this vulnerability is severe due to its potential for widespread data theft and session hijacking. Once the malicious script executes in the victim's browser, it operates with the same privileges as the legitimate application code. Attackers can leverage JavaScript APIs to steal sensitive information such as authentication cookies, session tokens, or personal user data displayed on the page. Furthermore, the injected scripts can perform actions on behalf of the victim, including modifying site content, redirecting users to phishing sites, or defacing the website interface. Because WordPress often serves as a Content Management System for business-critical websites, such compromises can lead to significant reputational damage and loss of customer trust.
From a classification perspective, this vulnerability aligns with CWE-79, which denotes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involving the id attribute highlights a failure in both input validation and output encoding processes. In terms of offensive security frameworks, this attack pattern corresponds to the ATT&CK technique T1059.007, which covers JavaScript execution within web browsers. Understanding these mappings is crucial for developers and security teams to categorize the risk accurately and apply appropriate remediation strategies that address both the immediate code flaw and broader input handling practices.
To mitigate this vulnerability, site administrators should immediately update the Data Tables Generator plugin to version 1.12.04 or later, where the issue has been resolved through enhanced sanitization routines. For organizations unable to patch immediately due to compatibility constraints, implementing a Web Application Firewall can provide an additional layer of defense by filtering out malicious payloads before they reach the application logic. Additionally, enforcing strict least-privilege access controls ensures that only trusted administrators have contributor-level or higher permissions, thereby reducing the attack surface available to potential intruders. Regular security audits and code reviews focusing on input/output handling are essential preventive measures against similar vulnerabilities in WordPress plugins.