The wpDataTables plugin for WordPress suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the prepareCellOutput() method of LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. This allows unauthenticated attackers to inject malicious scripts if they can convince an administrator to import attacker-controlled data containing payloads in affected column types. The vulnerability affects all versions up to and including 6.5.0.4. The CVSS 3.1 base score is 4.7, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

Successful exploitation can lead to execution of arbitrary scripts in the context of the affected site, potentially compromising user confidentiality and integrity. The attack requires tricking an administrator into importing malicious data, limiting the attack vector. There is no impact on availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid importing data from untrusted or attacker-controlled sources, especially when using Link, Image, or Email column types. Monitoring vendor channels for updates is recommended.