Refine your search
3 vulnerabilities found for Data Tables Generator by Supsystic by supsysticcom
CVE-2026-14877 (GCVE-0-2026-14877)
Vulnerability from cvelistv5
Published
2026-10-10 05:31
Modified
2026-10-11 12:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| supsysticcom | Data Tables Generator by Supsystic |
Version: 0 ≤ 1.12.03 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14877",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:15:18.480467Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:56.994Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Data Tables Generator by Supsystic",
"vendor": "supsysticcom",
"versions": [
{
"lessThanOrEqual": "1.12.03",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Webbernaut"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T05:31:05.478Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e04ed3b3-b463-4597-9307-42017a672bb2?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3608322/data-tables-generator-by-supsystic"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-08T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2026-07-06T15:44:24.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T16:49:49.000Z",
"value": "Disclosed"
}
],
"title": "Data Tables Generator by Supsystic \u003c= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table \u0027id\u0027 HTML Attribute"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14877",
"datePublished": "2026-10-10T05:31:05.478Z",
"dateReserved": "2026-07-06T15:28:37.895Z",
"dateUpdated": "2026-10-11T12:23:56.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96648 (GCVE-0-2026-96648)
Vulnerability from cvelistv5
Published
2026-10-10 04:26
Modified
2026-10-11 12:23
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin's 'access_roles' setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| supsysticcom | Data Tables Generator by Supsystic |
Version: 0 ≤ 1.15.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-11T12:18:23.510490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:23:59.552Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Data Tables Generator by Supsystic",
"vendor": "supsysticcom",
"versions": [
{
"lessThanOrEqual": "1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "braintx"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell \u0027data\u0027 Value via updateRows Action in all versions up to, and including, 1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable by Subscriber-level users when an administrator has added their role to the plugin\u0027s \u0027access_roles\u0027 setting, which is a documented and explicitly supported plugin feature that grants lower-privileged users access to the dtgs_nonce required to reach the vulnerable updateRows action handler."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T04:26:42.279Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/12316a14-57e9-4e00-ad6b-04df3b169d73?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Tables/Model/Tables.php#L349"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Tables/views/shortcode.twig#L151"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Tables/Controller.php#L529"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Tables/Model/Tables.php#L1028"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Core/BaseController.php#L94"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/tags/1.15.0/src/SupsysticTables/Core/Module.php#L103"
},
{
"url": "https://plugins.trac.wordpress.org/browser/data-tables-generator-by-supsystic/"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3721225/data-tables-generator-by-supsystic/trunk/src/SupsysticTables/Tables/Model/Tables.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-23T14:56:47.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-09T15:29:34.000Z",
"value": "Disclosed"
}
],
"title": "Data Tables Generator by Supsystic \u003c= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell \u0027data\u0027 Value via updateRows Action"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-96648",
"datePublished": "2026-10-10T04:26:42.279Z",
"dateReserved": "2026-09-23T14:41:42.517Z",
"dateUpdated": "2026-10-11T12:23:59.552Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12089 (GCVE-0-2025-12089)
Vulnerability from cvelistv5
Published
2025-11-13 03:27
Modified
2026-04-08 16:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| supsysticcom | Data Tables Generator by Supsystic |
Version: 0 ≤ 1.10.45 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-13T14:28:17.235371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T14:34:40.979Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Data Tables Generator by Supsystic",
"vendor": "supsysticcom",
"versions": [
{
"lessThanOrEqual": "1.10.45",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Naoya Takahashi"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the cleanCache() function in all versions up to, and including, 1.10.45. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:37:03.374Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/15e671e5-a9a6-4439-93cc-8d46fe0cde16?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3394112%40data-tables-generator-by-supsystic\u0026new=3394112%40data-tables-generator-by-supsystic\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2025-10-29T20:44:51.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-11-12T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Data Tables Generator by Supsystic \u003c= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-12089",
"datePublished": "2025-11-13T03:27:36.705Z",
"dateReserved": "2025-10-22T18:19:15.845Z",
"dateUpdated": "2026-04-08T16:37:03.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}