{
 "id": "WPSEC-2026-1967",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1967/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1967/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1967/index.md",
 "title": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Stored Cross-Site Scripting via Data Table Cell Values",
 "description": "The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via table data rendered by the Data Tables (publication) feature in all versions up to, and including, 5.5.89. The cause is insufficient output escaping of cell values, of row values placed into hyperlink and image URL attributes, and of hyperlink labels. The only filter was a literal replacement of '<script>' tags, which does not stop event-handler attributes or quote breakouts. This makes it possible for unauthenticated attackers who can write data into a table shown by a published Data Table (for example through a public data entry form) to inject arbitrary web scripts that execute whenever a user views the table.",
 "plugin": {
  "slug": "wp-data-access",
  "name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "full_name": "WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps",
  "wordpress_org": "https://wordpress.org/plugins/wp-data-access/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-data-access/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-data-access"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.5.90",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.5.90"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.5.90",
 "remediation": "Update to 5.5.90 or later.",
 "fix_released": "2026-10-28T18:01:26+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:42:20.508749+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1967/",
  "https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/",
  "https://wordpress.org/plugins/wp-data-access/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-data-access",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-29"
 }
}