Unauthenticated Cross Site Scripting in the WordPress wpDataTables plugin allows an attacker to inject malicious JavaScript that runs in the context of users visiting an affected website. Based on the description, it is inferred that the XSS could be used to steal credentials, deface content, or redirect users to malicious sites. The flaw is classified as CWE-79, and based on that classification it is inferred that the issue originates from improper input validation and sanitization.

This issue affects WordPress sites that have installed Melograno Venture Studio's wpDataTables plugin version 6.5.1.4 or earlier. The plugin integrates with the WordPress CMS and is commonly used on sites that display data tables.

The CVSS base score of 7.1 indicates a high severity. Because the vulnerability is unauthenticated, any website visitor can trigger the XSS. Based on the data, it is inferred that EPSS data being unavailable means the current probability of exploitation is unknown, and a lack of a KEV listing does not reduce the risk. It is inferred that an attacker could embed malicious payloads via any input accepted by the plugin; because the flaw operates client‑side, such payloads could potentially be replayed across domains. The combination of a high CVSS score, unauthenticated access, and the ability to inject arbitrary scripts presents a serious threat for any public WordPress site using the affected plugin version.