Stored Cross-Site Scripting in Supsystic Data Tables Generator Plugin for WordPress

CVE-2026-96648

What is CVE-2026-96648?

The Data Tables Generator by Supsystic plugin for WordPress is prone to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping in the handling of the 'data' value within table cells via the updateRows Action. Authenticated attackers with subscriber-level access or higher can exploit this vulnerability to inject malicious web scripts into pages, which will execute each time a user visits an affected page. The risk is notably present when an administrator has configured their roles within the plugin's 'access_roles' settings, allowing lower-privileged users access to sensitive actions. Sites utilizing this plugin versions up to and including 1.15.1 should take immediate steps to secure their installations.

References