What’s Vulnerable › Vulnerabilities

CVE-2022-29432: WordPress wpDataTables plugin <= 2.1.27 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-20 · updated 2026-06-17
• Weakness: CWE-79

Description

Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.

Affected products

• wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin: through 2.1.27

References

• https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
• https://wordpress.org/plugins/wpdatatables/#developers
• https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-multiple-authenticated-persistent-cross-site-scripting-xss-vulnerabilities
• https://wordpress.org/plugins/wpdatatables/#developers

Get alerted when CVE-2022-29432 or the next vulnerability affects your stack