CVE-2026-57672: wpDataTables XSS Vulnerability

CVE-2026-57672 Overview

CVE-2026-57672 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the wpDataTables WordPress plugin in versions up to and including 6.5.1.1. The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. Attackers can inject malicious script content that executes in the browsers of users interacting with crafted requests or links. Because no authentication is required, any remote actor can attempt exploitation against affected sites.

Critical Impact
Successful exploitation allows attackers to execute arbitrary JavaScript in victims' browsers, enabling session theft, credential harvesting, and unauthorized actions against WordPress sites running vulnerable wpDataTables versions.

Affected Products

wpDataTables WordPress plugin versions <= 6.5.1.1
WordPress sites with the wpDataTables plugin installed and activated
Any environment exposing wpDataTables endpoints to unauthenticated users

Discovery Timeline

2026-07-02 - CVE-2026-57672 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57672

Vulnerability Analysis

The vulnerability stems from improper neutralization of user-supplied input rendered back into HTML responses by the wpDataTables plugin. The plugin fails to sanitize or encode input before echoing it into the page context. Attackers can craft requests containing JavaScript payloads that browsers execute when a victim loads the response.

Because the issue is reachable without authentication, exploitation does not require account credentials or elevated privileges. The scope change reflected in the CVSS metrics indicates the injected script affects resources beyond the initially vulnerable component, such as the authenticated WordPress admin session context. User interaction is required, typically achieved through phishing or a crafted link.

Root Cause

The root cause is missing output encoding and insufficient input validation in wpDataTables request handlers that render user-controlled parameters into HTML. Data flowing from HTTP request parameters into the response body is not passed through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses() before reaching the browser.

Attack Vector

An attacker crafts a URL or form submission targeting a vulnerable wpDataTables endpoint containing a JavaScript payload. The attacker distributes the link through phishing emails, chat channels, or malicious sites. When an administrator or other privileged WordPress user follows the link, the injected script executes with the privileges of that user's session. The attacker can then exfiltrate cookies, perform administrative actions, plant persistent backdoors, or pivot to further compromise.

For technical specifics, consult the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2026-57672

Indicators of Compromise

HTTP requests to wpDataTables endpoints containing <script>, javascript:, onerror=, or onload= payloads in query parameters or POST bodies.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting plugin pages.
New or modified WordPress administrator accounts, plugins, or theme files following user interaction with suspicious links.

Detection Strategies

Inspect web server access logs for requests to wpDataTables paths containing URL-encoded HTML tags or JavaScript event handlers.
Deploy a Web Application Firewall (WAF) with XSS signatures tuned for WordPress plugin parameters.
Correlate referrer headers and browser telemetry to identify users who followed external links into wpDataTables endpoints.

Monitoring Recommendations

Enable and centralize WordPress audit logging to capture administrative actions initiated after link clicks.
Monitor endpoint browser processes for anomalous script execution and outbound connections from admin workstations.
Alert on modifications to WordPress core files, wp-config.php, and plugin directories that occur without a corresponding administrative session.

How to Mitigate CVE-2026-57672

Immediate Actions Required

Update wpDataTables to a version newer than 6.5.1.1 as soon as a patched release is published by the vendor.
Restrict access to WordPress administrative interfaces using IP allowlists or VPN gateways until the plugin is updated.
Instruct administrators to avoid clicking untrusted links referencing wpDataTables endpoints.

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the current patch status and vendor-supplied fixed version. Apply updates through the WordPress plugin manager or wp-cli and validate the installed version after upgrade.

Workarounds

Deploy WAF rules blocking requests to wpDataTables paths that contain HTML tags, JavaScript event handlers, or javascript: URIs.
Set restrictive Content-Security-Policy headers on WordPress sites to limit inline script execution and untrusted script sources.
Temporarily deactivate the wpDataTables plugin on sites where the feature is not business-critical until a fixed version is installed.

bash

# Configuration example: enforce a strict Content-Security-Policy via .htaccess
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff"