WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Stored Cross-Site Scripting via Data Table Cell Values
- ID
- WPSEC-2026-1967
- Plugin
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (wp-data-access)
- Affected
- all versions before 5.5.90
- Remediation
- Update to 5.5.90 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-29
- Attack surface
- WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps on WPSec AttackSurface
- Fix released
- Published
Description
The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via table data rendered by the Data Tables (publication) feature in all versions up to, and including, 5.5.89. The cause is insufficient output escaping of cell values, of row values placed into hyperlink and image URL attributes, and of hyperlink labels. The only filter was a literal replacement of '<script>' tags, which does not stop event-handler attributes or quote breakouts. This makes it possible for unauthenticated attackers who can write data into a table shown by a published Data Table (for example through a public data entry form) to inject arbitrary web scripts that execute whenever a user views the table.
References
- https://wpsec.com/vuln/WPSEC-2026-1967/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/
- https://wordpress.org/plugins/wp-data-access/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS