---
id: "CVE-2026-118204"
page: "https://infrastack.ai/live/CVE-2026-118204"
kind: "vulnerability"
aliases: ["CVE-2026-118204"]
title: "WordPress WP Data Access plugin: stored XSS via table image column"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-data-access"]
not_affected_if: ["default-config", "no-shortcode-over-user-data"]
published_at: "2026-11-07T07:17:03+00:00"
first_seen_at: "2026-11-07T07:46:07+00:00"
updated_at: "2026-11-07T07:47:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118204", "first_seen_at": "2026-11-07T07:46:07+00:00"}]
exploit_sources: []
---

# WordPress WP Data Access plugin: stored XSS via table image column

Link for people: https://infrastack.ai/live/CVE-2026-118204 (this .md is for agents)

The WP Data Access WordPress plugin does not sanitize or escape the ImageURL column value in DataTables shortcodes, so a logged-in subscriber can store script that runs for anyone who opens the affected page. Exploitation requires an administrator to have published a shortcode over an attacker-controlled column with the Image URL media type.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin version in the WordPress admin plugins list; the sources state versions up to and including `5.5.89` are affected
- Search published pages and posts for WP Data Access DataTables shortcodes that use an Image URL column over user-editable fields such as `wp_usermeta.description`

## Fix

- WP Data Access plugin: unknown, the sources do not state a fixed version

## Timeline

- 2026-11-07T07:46:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118204

## From the sources

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ImageURL column value (populated from wp_usermeta.description in the demonstrated path)' parameter in all versions up to, and including, 5.5.89 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a DataTables shortcode over a database column the attacker controls (e.g., wp_usermeta.description) with the Image URL media type assigned to that column — both are supported plugin features but are not enabled by default.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_