CVE-2026-118204

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value (populated from wp_usermeta.description in the demonstrated path)' parameter in all versions up to, and including, 5.5.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a DataTables shortcode over a database column the attacker controls (e.g., wp_usermeta.description) with the Image URL media type assigned to that column — both are supported plugin features but are not enabled by default.

• CWE-79

• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/WPDataAccess/Data_Tables/WPDA_Data_Tables.php#L1017
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/WPDataAccess/Data_Tables/WPDA_Data_Tables.php#L1062
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.88/includes/class-wp-data-access.php#L490
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3771310%40wp-data-access%2Ftags%2F5.5.90&old=3761178%40wp-data-access%2Ftags%2F5.5.89
• https://www.wordfence.com/threat-intel/vulnerabilities/id/64fedaf1-3edf-43e9-8521-95a5efa1c8f4?source=cve

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118199Photoshop Desktop is affected by an out-of-bounds read vulne…5.5
• CVE-2026-1182GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-11820A flaw was found in the community.general Ansible collection…6.5
• CVE-2026-118200Photoshop Desktop is affected by an out-of-bounds read vulne…5.5
• CVE-2026-118201The Limit Login Attempts Security WordPress plugin before 3…7.5
• CVE-2026-118202The Limit Login Attempts Security WordPress plugin before 3…7.5
• CVE-2026-118205The Essential Addons for Elementor – Popular Elementor Templ…7.4
• CVE-2026-118207Improper input validation in Microsoft Exchange Server allow…8.8
• CVE-2026-118208Improper access control in Microsoft Exchange Server allows …7.1
• CVE-2026-11821The Eventin – Event Calendar, Event Registration, Tickets & …5.4
• CVE-2026-118213Relative path traversal in Windows Deployment Services allow…5.9
• CVE-2026-118214Use of uninitialized resource in Windows Advanced Rasterizat…6.5