CVE-2026-96648

Name of the Vulnerable Software and Affected Versions Data Tables Generator by Supsystic versions prior to 1.15.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the updateRows action through the data variable of a table cell. The issue is exploitable by subscriber-level users if an administrator has added their role to the access roles setting, which provides the dtgs nonce required to access the vulnerable handler.

Recommendations Update Data Tables Generator by Supsystic to version 1.15.2 or later. Restrict the access roles setting to prevent lower-privileged users from accessing the updateRows action.