Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →

Free tool

Is my WordPress plugin safe?

Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.

Plugin · wpdatatables

wpdatatables

19 known vulnerabilities on record. Add your version above to see which ones affect you.

Is wpdatatables safe? The full page →

  • Aug 20, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.CVE-2026-66597 · affects up to 6.5.1.4 · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions.

    NVD recordpatchstack.com

  • Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.CVE-2026-65509 · affects up to 7.5.1 · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 7.5.1 versions.

    NVD recordpatchstack.com

  • Jul 2, 2026Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.CVE-2026-57672 · reported by PatchstackHigh 7.1

    Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.1 versions.

    NVD recordpatchstack.com

  • Jun 26, 2026Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.CVE-2026-54825 · affects up to 7.4 · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in wpDataTables <= 7.4 versions.

    NVD recordpatchstack.com

  • Jun 17, 2026Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.CVE-2026-49080 · affects up to 7.3.6 · reported by PatchstackCritical 9.3

    Unauthenticated SQL Injection in wpDataTables <= 7.3.6 versions.

    NVD recordpatchstack.com

  • Apr 20, 2026wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: Stored Cross-Site ScriptingCVE-2026-5721 · affects up to 6.5.0.4 · reported by WordfenceMedium 4.7

    The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.5.0.4. This is due to insufficient input sanitization and output escaping in the prepareCellOutput() method of the LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, given that they can trick an Administrator into importing data from an attacker-controlled source and the affected column types (Link, Image, or Email) are configured.

    NVD recordplugins.trac.wordpress.orgwordfence.com

  • Mar 5, 2026wpDataTables: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2026-28039 · affects up to 6.5.0.1 · reported by PatchstackHigh 7.5

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMS wpDataTables wpdatatables allows PHP Local File Inclusion.This issue affects wpDataTables: from n/a through 6.5.0.1.

    NVD recordpatchstack.com

  • Jun 1, 2024wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: Unauthorized accessCVE-2024-3821 · affects up to 6.3.2 · reported by WordfenceHigh 7.3

    The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the wdt_ajax_actions.php file in all versions up to, and including, 6.3.2. This makes it possible for unauthenticated attackers to manipulate data tables. Please note this only affects the premium version of the plugin.

    NVD recordwpdatatables.comwordfence.com

  • Jun 1, 2024wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: SQL InjectionCVE-2024-3820 · affects up to 6.3.1 · reported by WordfenceCritical 10

    The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to SQL Injection via the 'id_key' parameter of the wdt_delete_table_row AJAX action in all versions up to, and including, 6.3.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Please note this only affects the premium version of the plugin.

    NVD recordwpdatatables.comwordfence.com

  • May 22, 2024wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: Stored Cross-Site ScriptingCVE-2024-4895 · affects up to 3.4.2.12 · reported by WordfenceMedium 4.7

    The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CSV import functionality in all versions up to, and including, 3.4.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

    NVD recordplugins.trac.wordpress.orgwordpress.org

  • Mar 13, 2024wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts: Reflected Cross-Site ScriptingCVE-2024-0591 · affects up to 3.4.2.2 · reported by WordfenceMedium 6.1

    The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'A' parameter in all versions up to, and including, 3.4.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

    NVD recordplugins.svn.wordpress.orgplugins.svn.wordpress.org

  • Sep 11, 2023wpDataTables: Does not validate the "Serialized PHP array" input data before deserializing the dataCVE-2023-4314 · fixed in 2.1.66 · reported by WPScanHigh 7.2

    The wpDataTables WordPress plugin before 2.1.66 does not validate the "Serialized PHP array" input data before deserializing the data. This allows admins to deserialize arbitrary data which may lead to remote code execution if a suitable gadget chain is present on the server. This is impactful in environments where admin users should not be allowed to execute arbitrary code, such as multisite.

    NVD recordwpscan.comwpscan.com

  • May 3, 2023Auth.CVE-2023-23876 · fixed in 2.1.50 · reported by PatchstackMedium 6.5

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TMS-Plugins wpDataTables plugin <= 2.1.49 versions.

    NVD recordpatchstack.compatchstack.com

  • May 20, 2022Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 onCVE-2022-29432 · affects up to 2.1.27 · reported by PatchstackLow 3.4

    Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.

    NVD recordpatchstack.comwordpress.org

  • Apr 4, 2022wpDataTables: Authenticated (admin+) Stored Cross-Site Scripting (XSS)CVE-2022-25618 · affects up to 2.1.27 · reported by PatchstackLow 3.4

    Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27

    NVD recordpatchstack.comwordpress.org

  • Feb 7, 2021wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.CVE-2021-26754 · fixed in 3.4.1 · reported by MITRECritical 9.8

    wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection.

    NVD recordn4nj0.github.iowordpress.org

  • Dec 26, 2019the wpDataTables Lite Version 2.0.11 and earlier: SQL injectionCVE-2019-6012 · affects up to 2.0.11 · reported by vultures@jpcert.or.jpHigh 7.2

    SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors.

    NVD recordjvn.jpwordpress.org

  • Dec 26, 2019wpDataTables Lite Version 2.0.11 and earlier: Cross-site scriptingCVE-2019-6011 · affects up to 2.0.11 · reported by vultures@jpcert.or.jpMedium 6.1

    Cross-site scripting vulnerability in wpDataTables Lite Version 2.0.11 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

    NVD recordjvn.jpwordpress.org

  • Dec 2, 2014SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commCVE-2014-9175 · affects up to 1.5.3 · reported by MITREHigh 7.5

    SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_id parameter in a get_wdtable action to wp-admin/admin-ajax.php.

    NVD recordpacketstormsecurity.comexploit-db.com

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.