CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N
What the vulnerability does
Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.
Explanation of Vulnerability in Simple Terms
The wpDataTables plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 2.1.27. An authenticated user with high privileges can inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction to trigger and affects the integrity of the site's content.
What an attacker can do
Inject malicious scripts that run in other users' browsers when they view affected pages.
Potential impact on your site
A compromised admin or editor account can deface content, steal visitor data, or redirect users to malicious sites.
Conditions required to exploit
Attacker must have high-level WordPress privileges (e.g., admin or editor role) and a victim must visit the affected page.
Key dates
External resources
Related vulnerabilities
