medium · CVSS v3 6.4

CVE-2026-118204

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with su

Overview

The WP Data Access – App Builder plugin for WordPress is vulnerable to stored XSS via the ImageURL column value. Authenticated users with subscriber-level access can inject scripts that run when others view the page. This flaw allows malicious code to execute in the context of site visitors.

Description

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value (populated from wp_usermeta.description in the demonstrated path)' parameter in all versions up to, and including, 5.5.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a DataTables shortcode over a database column the attacker controls (e.g., wp_usermeta.description) with the Image URL media type assigned to that column — both are supported plugin features but are not enabled by default.

Impact

Confidentiality: attackers can steal cookies or session data via injected scripts. Integrity: malicious scripts can modify page content. Availability: not directly impacted. Defenders: site admins and users of the plugin.

Remediation

Update the WP Data Access plugin to version 5.5.90 or later. If update is not possible, disable the ImageURL column or restrict DataTables shortcode usage to trusted users. Sanitize wp_usermeta.description or use a plugin that escapes output.

Risk context

Medium severity (CVSS 6.4). No EPSS data available. Defenders should address promptly to prevent XSS exploitation.

Affected products

  • WordPress
  • WP Data Access – App Builder

Scores

Severity
medium
CVSS v2
5.5
CVSS v3
6.4
CVSS v4
—
EPSS
—

wordpress xss stored-xss wp-data-access plugin authentication defense

← All CVEs

Related CVEs

medium

CVE-2026-118528

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers with Subscriber-level access and above to disclose another user's private and unpublished draft listing details, including contact information.

View analysis

medium

CVE-2026-121792

The GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI plugin for WordPress is vulnerable to generic SQL Injection via the 'input_ . (Gravity Forms name-field part, or list-field row)' parameter in all versions up to, and including, 8.1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a GamiPress achievement already configured against a Gravity Forms 'field value submission' event with the corresponding form published — a standard setup for sites using the integration.

View analysis

medium

CVE-2026-93902

The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via Social Profile Fields in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is scoped to the attacker's own user meta but is exposed publicly on their author archive page at /author/ /, which is accessible to unauthenticated visitors regardless of whether the attacker has published any posts.

View analysis

medium

CVE-2026-97189

The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.

View analysis