CVE-2026-96648

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site…

Risk score: 41/100
CVSS: 6.4 v3.1
Exploit chance (30 days): 0.2%
Published: 10 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with su…
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.4 medium

References

Original description

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.

Last activity 10 Oct 2026. Patch Forecast updates every hour.