This vulnerability is a stored cross‑site scripting flaw in wpDataTables, a WordPress plugin. Insufficient sanitization and escaping of data in the prepareCellOutput() method allows an attacker to embed malicious scripts into table cells of the Link, Image, or Email column types. When a user opens a page containing the compromised table, the arbitrary script executes in the user’s browser, potentially enabling cookie theft, session hijacking, defacement, or other client‑side attacks. The flaw is classified as CWE-79.

WordPress installations running wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin version 6.5.0.4 or earlier. The vulnerability affects any site that uses the Link, Image, or Email column types within the plugin.

The CVSS score of 4.7 indicates a medium impact, and the EPSS score is currently not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by tricking an administrator into importing a malicious CSV or Excel file containing script‑laden data; this is inferred from the description and is a remote attack vector with the prerequisite of an admin action. Once the data is imported, any user who visits the page will have the script executed in their browser.