Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Table Cell Content and Custom CSS
- ID
- WPSEC-2026-0034
- Plugin
- Data Tables Generator by Supsystic (data-tables-generator-by-supsystic)
- Affected
- all versions before 1.15.3
- Remediation
- Update to 1.15.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Data Tables Generator by Supsystic on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-96648, on 2026-10-09.
Description
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via table cell content, the table description and signature settings, and the custom CSS setting in all versions up to, and including, 1.15.1. This is due to the plugin's sanitization routine decoding HTML entities after filtering with wp_kses (and decoding cell values again on output), which turns entity-encoded payloads back into live tags, and to custom CSS being printed unescaped inside a style element. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page displaying the table. This only affects multi-site installations and installations where unfiltered_html has been disabled, unless lower-privileged roles have been granted table access through the plugin's (Pro) Roles setting, in which case users with those roles can exploit it.
References
- https://wpsec.com/vuln/WPSEC-2026-0034/
- https://plugins.svn.wordpress.org/data-tables-generator-by-supsystic/tags/1.15.3/
- https://wordpress.org/plugins/data-tables-generator-by-supsystic/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS