PT-2026-33857 · WordPress · Wpdatatables

Published 2026-04-20 · Updated 2026-04-26 · CVE-2026-5721

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin versions prior to 6.5.0.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the prepareCellOutput() function of the LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. Unauthenticated attackers can inject arbitrary web scripts into pages. These scripts execute when a user accesses the page, provided an Administrator is tricked into importing data from an attacker-controlled source and the affected column types (Link, Image, or Email) are configured.

Recommendations Update the plugin to a version later than 6.5.0.4.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5721

Affected Products

Wpdatatables

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5721 · Security Note
• https://twitter.com/atomicedgeWAF/status/2048274178831261746 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3510613 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8db736fb-cd6c-4a52-9dd3-eefd0a8d9267?source=cve · Note
• https://twitter.com/CVEnew/status/2046571888793858061 · Twitter Post