CVE-2026-118204

Name of the Vulnerable Software and Affected Versions WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps versions prior to 5.5.90

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting (XSS). This occurs via the ImageURL column value (populated from wp usermeta.description in the demonstrated path) parameter. An attacker can inject arbitrary web scripts into pages that execute when a user accesses them. This requires an administrator to have published a DataTables shortcode over a database column controlled by the attacker, such as wp usermeta.description, with the Image URL media type assigned to that column.

Recommendations Update WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps to version 5.5.90 or later.