This vulnerability (CVE-2026-66597) is an unauthenticated cross-site scripting (XSS) flaw in wpDataTables versions up to 6.5.1.4. It stems from improper neutralization of input during web page generation, classified under CWE-79. The CVSS 3.1 score is 7.1, indicating high severity, with an attack vector of network, low attack complexity, no privileges required, and requiring user interaction. The scope is changed, and the impacts include low confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no official patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows unauthenticated attackers to inject malicious scripts into web pages generated by wpDataTables, potentially leading to partial compromise of confidentiality, integrity, and availability of affected systems. This can result in actions such as session hijacking, defacement, or other malicious activities that rely on executing arbitrary scripts in the context of the victim's browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling or restricting access to the vulnerable plugin or limiting user input that can be rendered by wpDataTables. Monitor vendor channels for updates and apply patches promptly once available.