The vulnerability is a stored cross‑site scripting flaw in the WP Data Access plugin. Attackers can inject malicious scripts through the 'ImageURL' column of a DataTable when that column is configured to use the Image URL media type and is populated from a database column such as wp_usermeta.description. Because the plugin does not sanitize or escape the value, any script injected will be rendered in the HTML of pages that display the table. An attacker with subscriber‑level or higher access can thus execute arbitrary JavaScript in the browsers of all users who view the affected page, enabling actions such as cookie theft, session hijacking, or defacement.

The flaw affects the WordPress plugin WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps from the vendor PeterschuLz NL. All plugin releases up to and including version 5.5.89 are vulnerable. Users who have published a DataTables shortcode that references a database column control by an attacker, such as wp_usermeta.description, and configured that column to use the Image URL media type, are at risk.

The CVSS score of 6.4 indicates a moderate level of severity. The EPSS score is not available, so the current probability of exploitation is uncertain, but the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires an authenticated user with subscriber or higher privileges and the ability to deploy an affected DataTable shortcode. Once those conditions are met, the attacker can inject and persist malicious scripts that will execute whenever any site visitor loads the affected page. Because the flaw is a stored XSS, its impact is broad and can affect all users who view the injected pages.