CVE-2026-57672
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The wpDataTables plugin version 6.5.1.1 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script without requiring authentication.
Risk Assessment
The risk involves potential execution of arbitrary JavaScript in users' browsers, which can lead to session theft, redirects to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the wpDataTables plugin to a version newer than 6.5.1.1. Also consider deploying Web Application Firewalls (WAF) that block common XSS patterns.
Other vulnerabilities in wpDataTables
See all- CVE-2026-66597High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to 6.5.1.4. An attacker can inject malicious script without authentication.
- CVE-2026-49080Critical
There is an unauthenticated SQL injection vulnerability in wpDataTables versions up to 7.3.6.
- CVE-2026-65509High
Unauthenticated Cross Site Scripting (XSS) in wpDataTables versions up to and including 7.5.1.
- CVE-2026-28039High
The wpDataTables WordPress plugin (through 6.5.0.1) contains a PHP Local File Inclusion vulnerability due to improper control of filename in include/require statements.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS