CVE-2026-65509 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in wpDataTables versions <= 7.5.1. The vulnerability allows remote attackers to execute arbitrary scripts in the context of the affected application without needing any privileges. The CVSS 3.1 score is 7.1 (High), indicating that the attack vector is network-based with low attack complexity, no privileges required, but requires user interaction. The vulnerability affects confidentiality, integrity, and availability to a limited extent.

Successful exploitation can lead to partial disclosure of information, modification of data, and disruption of service due to script execution in the victim's browser context. Since the vulnerability is unauthenticated, it can be exploited by any remote attacker without credentials. User interaction is required, which typically means a victim must visit a crafted URL or page.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting wpDataTables or disabling the plugin if feasible.