The wpDataTables – WordPress Data Table

CVE-2026-5721 is a stored cross-site scripting flaw in the wpDataTables plugin for WordPress — the plugin used to render dynamic data tables and charts on tens of thousands of WordPress sites. An attacker who can reach the table-editing surface can inject JavaScript that gets persisted in table cell/config data and executed later in another user's browser session when the table is rendered or previewed. The vector is AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N — network reachable, high attack complexity, no privileges required, but user interaction is required and the impact is a *scope-changed* low confidentiality and integrity hit (typical of DOM/session-context XSS).

The vendor MEDIUM (4.7) rating is honest. This is not an unauth RCE, it is not an admin takeover primitive on its own, and the AC:H reflects real preconditions: the attacker needs a plausible path to inject into a table configuration, and a privileged user has to render or interact with the poisoned view. Stored XSS in a widely-deployed plugin still deserves attention because a triggered payload runs in the admin's browser context and can pivot to nonce theft or account creation, but the base severity is not being under-called.

Why this verdict

• Vendor severity matches reality: AC:H and UI:R are load-bearing — the attacker cannot fire this at scale against unauthenticated visitors and expect reliable execution against an admin.
• Role multiplier — bounded blast radius: wpDataTables runs on WordPress content sites; even worst-case chained-to-admin-takeover impact is single-site compromise, not fleet, identity, or supply-chain scale. This does NOT invoke a HIGH floor.
• No KEV, low EPSS (0.00272), no observed campaigns — threat pressure is low.
• Downgrade pressure from AC:H: most enterprise WordPress installs restrict wpDataTables editing to trusted roles, further shrinking the reachable population.

Why not higher?

Not HIGH because there is no unauthenticated primitive, impact is C:L/I:L not full compromise, user interaction from a privileged user is required, and wpDataTables is not a high-value-role component (not an IdP, hypervisor, PAM, backup, edge appliance, or kernel agent). No KEV listing and negligible EPSS reinforce that this is not near-term operationally urgent.

Why not lower?

Not LOW because stored XSS in a WordPress plugin used by an administrator can be chained to full site takeover (add-admin, install-plugin, drop-webshell) via nonce theft, and the plugin has a non-trivial install base. A defender who ignores it entirely accepts real single-site takeover risk on WordPress properties running the plugin.

1. Upgrade wpDataTables to the patched release — Vendor patch is the definitive fix. No noisgate mitigation SLA for MEDIUM — schedule within the 365-day noisgate remediation SLA, prioritizing internet-facing WordPress properties first.
2. Restrict wpDataTables edit capability to admin role only — Confirm manage_options (or the plugin's specific capability) is not granted to Contributor/Author roles. Removes the low-privilege injection path pending patch.
3. Deploy Wordfence or Patchstack virtual patch rules — Both vendors publish signature-based virtual patches for wpDataTables XSS shortly after disclosure — enable auto-update of firewall rules on managed WP fleets.
4. Enforce 2FA on all admin and editor accounts — Blunts the chain from XSS-in-admin-browser to add-admin by requiring a fresh 2FA challenge on privileged operations (with plugins like WP 2FA / miniOrange).
5. Audit existing wpDataTables data for injected payloads — Query the plugin's tables for <script, onerror=, onload=, javascript: and <svg; treat any hit on a production site as an incident.

Run on the WordPress host as a user with read access to the WP install directory and DB credentials in wp-config.php. Requires wp-cli installed. Invoke as: ./check-cve-2026-5721.sh /var/www/html. Exits 0 for PATCHED, 1 for VULNERABLE, 2 for UNKNOWN.

#!/usr/bin/env bash
# check-cve-2026-5721.sh — detect vulnerable wpDataTables plugin
# Usage: ./check-cve-2026-5721.sh <wp-root>
set -u
WP_ROOT="${1:-/var/www/html}"
FIXED_VERSION="6.6.1"  # replace with vendor-confirmed fixed build

if [ ! -d "$WP_ROOT" ]; then
  echo "UNKNOWN: WordPress root $WP_ROOT not found"
  exit 2
fi

if ! command -v wp >/dev/null 2>&1; then
  echo "UNKNOWN: wp-cli not installed"
  exit 2
fi

INSTALLED=$(wp --path="$WP_ROOT" --allow-root plugin get wpdatatables --field=version 2>/dev/null || true)

if [ -z "$INSTALLED" ]; then
  echo "PATCHED: wpDataTables not installed"
  exit 0
fi

# semver compare
lowest=$(printf '%s\n%s\n' "$INSTALLED" "$FIXED_VERSION" | sort -V | head -n1)
if [ "$lowest" = "$FIXED_VERSION" ] && [ "$INSTALLED" != "$FIXED_VERSION" ]; then
  echo "PATCHED: wpDataTables $INSTALLED >= $FIXED_VERSION"
  exit 0
fi
if [ "$INSTALLED" = "$FIXED_VERSION" ]; then
  echo "PATCHED: wpDataTables $INSTALLED == fixed"
  exit 0
fi

echo "VULNERABLE: wpDataTables $INSTALLED < $FIXED_VERSION (CVE-2026-5721)"
exit 1

Sources

1. NVD — CVE-2026-5721
2. Wordfence Threat Intelligence Vulnerability Database
3. Patchstack Vulnerability Database — wpDataTables
4. wpDataTables official changelog
5. CWE-79: Improper Neutralization of Input During Web Page Generation
6. FIRST EPSS model
7. CISA KEV Catalog
8. WPScan Vulnerability Database