{"id":"CVE-2026-120479","kind":"vulnerability","aliases":["CVE-2026-120479"],"related":[],"title":"WP Data Access WordPress plugin: stored XSS via Data Projects simple form","description":"The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping on the value of TEXT/TINYTEXT/MEDIUMTEXT/LONGTEXT columns rendered by the WPDA_Simple_Form_Item_Textarea::show_item() method, which emits the stored column value directly inside a <textarea> element after only replacing '&' with '&amp;'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The WP Data Access plugin for WordPress fails to escape text column values rendered in a textarea on its front-end simple form. An attacker with a Subscriber account can store a script that runs in the browser of anyone who opens the affected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-data-access"],"not_affected_if":["front-end-form-unused","no-subscriber-registration","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or `wp plugin get wp-data-access --field=version` if WP-CLI is used.\n- Confirm whether the Data Projects front-end simple form is in use on the site.","fix":"- Versions up to and including `5.5.90` are affected; the sources do not name a fixed version.","status":"open","published_at":"2026-11-07T07:17:03+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","triaged_at":"2026-11-07T07:47:08+00:00","updated_at":"2026-11-07T07:47:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T07:47:08Z","model":"claude-haiku-5-5","output":{"fix":"- Versions up to and including `5.5.90` are affected; the sources do not name a fixed version.","reach":"internet","title":"WP Data Access WordPress plugin: stored XSS via Data Projects simple form","impact":"medium","summary":"The WP Data Access plugin for WordPress fails to escape text column values rendered in a textarea on its front-end simple form. An attacker with a Subscriber account can store a script that runs in the browser of anyone who opens the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-data-access"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Scripts run in visitors' browsers, enabling session theft or actions as them.","analyst_note":"Confirm the fixed version of wp-data-access after 5.5.90 from the WordPress plugin page or NVD entry.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen, or `wp plugin get wp-data-access --field=version` if WP-CLI is used.\n- Confirm whether the Data Projects front-end simple form is in use on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","front-end-form-unused","no-subscriber-registration"],"who_is_affected":"Sites running the WP Data Access plugin at version 5.5.90 or earlier that expose the Data Projects front-end simple form, where logged-in Subscriber-level users can submit data. Sites without that plugin or without the front-end form are not shown to be exposed. Whether the Subscriber role is open to outside registration on a given site is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000753,"input_tokens":4409,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120479':15A,18A '-2026':14A,17A '5.5.90':109C 'access':3A,24B,28B,74C,162C,178C 'account':54B 'affect':69B 'anyon':65B 'app':75C 'arbitrari':167C 'attack':50B,157C 'authent':156C 'browser':63B 'builder':76C 'chart':81C 'column':36B,125C,141C 'cross':91C 'cross-sit':90C 'cve':13A,16A 'dashboard':80C 'data':2A,9A,23B,27B,73C,96C 'direct':143C 'due':112C 'element':146C 'emit':138C 'end':46B,100C 'escap':34B,119C 'execut':174C 'fail':32B 'form':12A,48B,79C,102C,131C 'front':45B,99C 'front-end':44B,98C 'includ':108C 'inject':166C,180C 'input':115C 'insid':144C 'insuffici':114C 'item':132C,135C 'level':161C 'make':152C 'map':82C 'method':136C 'open':67B 'output':118C 'packag':19B 'page':70B,171C,181C 'plugin':5A,29B,83C 'possibl':154C 'project':10A,97C 'render':38B,126C 'replac':149C 'run':60B 'sanit':116C 'script':58B,93C,169C 'show':134C 'simpl':11A,47B,101C,130C 'site':92C 'store':6A,56B,89C,140C 'subscrib':53B,160C 'subscriber-level':159C 'tabl':78C 'text':35B 'text/tinytext/mediumtext/longtext':124C 'textarea':41B,133C 'user':177C 'valu':37B,122C,142C 'version':104C 'via':8A,94C 'vulner':87C 'web':168C 'whenev':175C 'wordpress':4A,20B,31B,85C 'wp':1A,22B,26B,72C 'wp-data-access':21B 'wpda':129C 'xss':7A","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Data Access plugin at version 5.5.90 or earlier that expose the Data Projects front-end simple form, where logged-in Subscriber-level users can submit data. Sites without that plugin or without the front-end form are not shown to be exposed. Whether the Subscriber role is open to outside registration on a given site is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wpdataaccess"],"campaign_type":null,"search_a":"'-120479':15A,18A '-2026':14A,17A 'access':3A 'cve':13A,16A 'data':2A,9A 'form':12A 'plugin':5A 'project':10A 'simpl':11A 'store':6A 'via':8A 'wordpress':4A 'wp':1A 'xss':7A","search_b":"'access':24B,28B 'account':54B 'affect':69B 'anyon':65B 'attack':50B 'browser':63B 'column':36B 'data':23B,27B 'end':46B 'escap':34B 'fail':32B 'form':48B 'front':45B 'front-end':44B 'open':67B 'packag':19B 'page':70B 'plugin':29B 'render':38B 'run':60B 'script':58B 'simpl':47B 'store':56B 'subscrib':53B 'text':35B 'textarea':41B 'valu':37B 'wordpress':20B,31B 'wp':22B,26B 'wp-data-access':21B","search_c":"'5.5.90':109C 'access':74C,162C,178C 'app':75C 'arbitrari':167C 'attack':157C 'authent':156C 'builder':76C 'chart':81C 'column':125C,141C 'cross':91C 'cross-sit':90C 'dashboard':80C 'data':73C,96C 'direct':143C 'due':112C 'element':146C 'emit':138C 'end':100C 'escap':119C 'execut':174C 'form':79C,102C,131C 'front':99C 'front-end':98C 'includ':108C 'inject':166C,180C 'input':115C 'insid':144C 'insuffici':114C 'item':132C,135C 'level':161C 'make':152C 'map':82C 'method':136C 'output':118C 'page':171C,181C 'plugin':83C 'possibl':154C 'project':97C 'render':126C 'replac':149C 'sanit':116C 'script':93C,169C 'show':134C 'simpl':101C,130C 'site':92C 'store':89C,140C 'subscrib':160C 'subscriber-level':159C 'tabl':78C 'text/tinytext/mediumtext/longtext':124C 'textarea':133C 'user':177C 'valu':122C,142C 'version':104C 'via':94C 'vulner':87C 'web':168C 'whenev':175C 'wordpress':85C 'wp':72C 'wpda':129C","first_public_at":"2026-11-07T07:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120479","severity":null,"published_at":"2026-11-07T07:17:03+00:00","modified_at":"2026-11-07T07:17:03+00:00","first_seen_at":"2026-11-07T07:46:07+00:00","fetched_at":"2026-11-07T07:46:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}