CVE-2026-65509 in wpDataTables Plugin
Summary
by MITRE • 08/06/2026
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified as unauthenticated cross site scripting in wpDataTables versions up to and including 7.5.1 represents a critical security flaw that allows attackers to execute malicious scripts within the context of a victim's browser without requiring authentication credentials. This vulnerability specifically affects WordPress plugins that utilize wpDataTables for data visualization and table rendering functionalities, creating an attack surface where malicious actors can inject harmful JavaScript code into web pages viewed by unsuspecting users.
The technical implementation of this XSS flaw stems from inadequate input validation and output sanitization within the plugin's handling of user-supplied data. When wpDataTables processes data for display in tables, it fails to properly escape or filter special characters that could be interpreted as HTML or JavaScript code. This occurs particularly when processing parameters passed through URL query strings, form inputs, or API endpoints that the plugin utilizes for dynamic content generation, allowing attackers to inject malicious scripts that execute in the context of legitimate user sessions.
The operational impact of this vulnerability extends beyond simple script execution, as it can enable sophisticated attacks such as session hijacking, credential theft, and data exfiltration from authenticated users. Attackers can craft malicious URLs containing XSS payloads that, when clicked by victims, can steal cookies, modify page content, redirect users to malicious sites, or perform actions on behalf of authenticated users. The unauthenticated nature of this vulnerability means that any visitor to a compromised WordPress site can exploit it without needing administrative privileges or user credentials, making it particularly dangerous in environments where the plugin is widely deployed.
From a threat modeling perspective, this vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws and maps to several ATT&CK techniques including T1566 for social engineering and T1059 for command and script injection. The attack surface is further expanded by the fact that wpDataTables is commonly used in business environments where sensitive data visualization occurs, making the potential impact of successful exploitation significantly higher than in typical consumer applications.
Organizations should immediately update to wpDataTables version 7.5.2 or later, which includes proper input sanitization and output escaping mechanisms to prevent malicious script injection. Additionally, administrators should implement Content Security Policy headers as an additional defense-in-depth measure, monitor web server logs for suspicious activity patterns, and consider implementing web application firewalls to detect and block known XSS attack vectors. Regular security auditing of WordPress plugins and maintaining updated security practices throughout the organization's digital infrastructure remain essential defensive measures against similar vulnerabilities that may arise in other third-party components.