# WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.89 - Unauthenticated Stored Cross-Site Scripting via Data Table Cell Values

- **ID:** WPSEC-2026-1967
- **Plugin:** WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps (`wp-data-access`), https://wordpress.org/plugins/wp-data-access/
- **Affected versions:** all versions before 5.5.90
- **Fixed in:** 5.5.90 (Update to 5.5.90 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-data-access
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1967/

## Description

The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via table data rendered by the Data Tables (publication) feature in all versions up to, and including, 5.5.89. The cause is insufficient output escaping of cell values, of row values placed into hyperlink and image URL attributes, and of hyperlink labels. The only filter was a literal replacement of '<script>' tags, which does not stop event-handler attributes or quote breakouts. This makes it possible for unauthenticated attackers who can write data into a table shown by a published Data Table (for example through a public data entry form) to inject arbitrary web scripts that execute whenever a user views the table.

## References

- https://wpsec.com/vuln/WPSEC-2026-1967/
- https://plugins.svn.wordpress.org/wp-data-access/tags/5.5.90/
- https://wordpress.org/plugins/wp-data-access/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1967/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.