CVE-2026-96648: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in supsysticcom Data Tables Generator by Supsystic

CVE-2026-96648 is a stored cross-site scripting vulnerability in the Data Tables Generator by Supsystic WordPress plugin, affecting all versions up to and including 1.15.1. The flaw occurs due to improper neutralization of input in the table cell 'data' value during the updateRows action. Exploitation requires authenticated access at subscriber level or above, with the subscriber role explicitly granted access to the dtgs_nonce via the plugin's 'access_roles' setting. Successful exploitation allows injection of malicious scripts that execute in the context of users viewing the compromised pages.

An attacker with subscriber-level access (or higher) who has been granted access via the plugin's 'access_roles' setting can inject arbitrary web scripts into pages. These scripts execute in the browsers of users who visit the injected pages, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability does not affect unauthenticated users and requires specific role configuration by an administrator.

No official patch or fix is currently documented. Administrators should review and restrict the 'access_roles' setting to prevent subscriber-level users from accessing the vulnerable updateRows action. Until a fix is available, limiting plugin access to trusted roles and monitoring for suspicious activity is recommended. Check the vendor advisory for updates on patches or official remediation.