CVE-2026-66597: WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress wpDataTables Pluginto a version that resolves this vulnerability.Fixed in 6.5.1.5
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as unauthenticated, so the attacker does not need a WordPress account or other authenticated access. Exploitation still requires user interaction, as indicated by the UI:R vector.
Which installations should be treated as affected?
Installations running wpDataTables version 6.5.1.4 or an earlier version should be treated as affected based on the provided version range. The available information does not state whether any particular configuration or feature must be enabled.
What is the potential impact if exploitation succeeds?
The supplied severity vector indicates low impacts to confidentiality, integrity, and availability, with scope changed. This is an XSS issue, meaning successful exploitation can involve attacker-controlled script execution in a user's browser.