CVE-2026-118048: WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label

Q: Who can exploit this issue in practice?

An authenticated WordPress user with at least Subscriber-level access can exploit it, but they must also be permitted to edit a lookup row through a legacy Form. The injected script can execute when another user accesses the affected page, including a higher-privileged user editing a linked record that uses the autocomplete relationship.

Q: Are sites using the plugin's default configuration necessarily affected?

The available information does not establish that a default configuration is affected. Exploitation depends on use of a legacy Form with a Simple Form autocomplete lookup relationship and on the attacker having permission to edit the relevant lookup row.

Q: How can administrators determine whether they may be exposed?

Review whether WP Data Access is installed at version 5.5.89 or earlier, and whether legacy Forms use Simple Form autocomplete lookup fields. Also identify lower-privileged authenticated users who can edit lookup rows, especially where those rows are linked to records accessed by administrators or other privileged users.

Q: What can be done if updating is not immediately possible?

Restrict or remove Subscriber-and-higher users' ability to edit lookup rows through legacy Forms, particularly rows used by autocomplete relationships. Review existing lookup-label values for injected markup or scripts and limit access to pages and records that render affected autocomplete labels.

Published Nov 7, 2026

Updated

The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Simple Form autocomplete lookup label in versions up to, and including, 5.5.89 This is due to insufficient output escaping on the value returned by WPDAAutocomplete::autocompletelookup() when it is emitted into a single-quoted HTML attribute by WPDASimpleFormItemAutocomplete::showitem() (the escape-output lint is explicitly suppressed on the echo line). This makes it possible for authenticated attackers, with Subscriber-level access and above, who are permitted to edit a lookup row through a legacy Form, to inject arbitrary web scripts in pages that will execute whenever a user — including a higher-privileged user editing a linked record that uses the autocomplete relationship — accesses the injected page.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:39 AM

Data Sourced

via MITRE·06:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue in practice?

An authenticated WordPress user with at least Subscriber-level access can exploit it, but they must also be permitted to edit a lookup row through a legacy Form. The injected script can execute when another user accesses the affected page, including a higher-privileged user editing a linked record that uses the autocomplete relationship.

Are sites using the plugin's default configuration necessarily affected?

The available information does not establish that a default configuration is affected. Exploitation depends on use of a legacy Form with a Simple Form autocomplete lookup relationship and on the attacker having permission to edit the relevant lookup row.

How can administrators determine whether they may be exposed?

Review whether WP Data Access is installed at version 5.5.89 or earlier, and whether legacy Forms use Simple Form autocomplete lookup fields. Also identify lower-privileged authenticated users who can edit lookup rows, especially where those rows are linked to records accessed by administrators or other privileged users.

What can be done if updating is not immediately possible?

Restrict or remove Subscriber-and-higher users' ability to edit lookup rows through legacy Forms, particularly rows used by autocomplete relationships. Review existing lookup-label values for injected markup or scripts and limit access to pages and records that render affected autocomplete labels.

CVE-2026-118048: WP Data Access <= 5.5.89 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label

Event History

Frequently Asked Questions

Who can exploit this issue in practice?

Are sites using the plugin's default configuration necessarily affected?

How can administrators determine whether they may be exposed?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in practice?

Are sites using the plugin's default configuration necessarily affected?

How can administrators determine whether they may be exposed?

What can be done if updating is not immediately possible?