wpDataTables

Vulnerabilities

• CVE-2021-26754

  wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injecti

  Critical 9.8

• CVE-2026-54825

  WordPress wpDataTables plugin <= 7.4 - SQL Injection vulnerability

  Critical 9.3

• CVE-2026-49080

  WordPress wpDataTables plugin <= 7.3.6 - SQL Injection vulnerability

  Critical 9.3

• CVE-2026-28039

  WordPress wpDataTables plugin <= 6.5.0.1 - Local File Inclusion vulnerability

  High 7.5

• CVE-2019-6012

  SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary S

  High 7.2

• CVE-2026-66597

  WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-65509

  WordPress wpDataTables plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2026-57672

  WordPress wpDataTables plugin <= 6.5.1.1 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2024-0591

  wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.

  Medium 6.1

• CVE-2019-6011

  Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or

  Medium 6.1

• CVE-2023-23876

  WordPress wpDataTables Plugin <= 2.1.49 is vulnerable to Cross Site Scripting (XSS)

  Medium 5.4

• CVE-2022-29432

  WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

  Medium 4.8

• CVE-2022-25618

  WordPress wpDataTables plugin <= 2.1.27 - Stored Cross-Site Scripting (XSS) vulnerability

  Medium 4.8

• CVE-2024-4895

  wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import

  Medium 4.7