Live › vulnerability › CVE-2026-120843
The Posts Table with Search & Sort WordPress plugin by Barn2 does not neutralize input when generating pages, so stored cross-site scripting is possible. An attacker who can get script into the stored data can run it in the browser of anyone who views the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the Posts Table with Search & Sort WordPress plugin at version 1.4.14 or older. Exposure depends on whether untrusted users can store content that is later rendered by the plugin; the sources do not say which roles or settings are required.
No product ranges from the sources yet.
1.4.141.4.14; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.
This page as .md · .json · in your agent: get_signal("CVE-2026-120843")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.