CVE-2026-14877

Executive Summary

CVE-2026-14877 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin "Data Tables Generator by Supsystic" affecting all versions up to and including 1.12.03. The flaw arises from insufficient input sanitization and output escaping of the id attribute, allowing an authenticated attacker with contributor-level access or above to inject arbitrary web scripts that execute when a victim views the injected page. Successful exploitation enables session theft, credential harvesting, and arbitrary client-side actions in the context of the victim's browser, with impact scored at CVSS 6.4 (Medium).

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting) and specifically manifests as a stored (persistent) XSS condition. Per the NVD description, the injection point is the id attribute used within the Data Tables Generator plugin. The root cause is twofold: the plugin fails to properly sanitize attacker-supplied input before storing it, and it fails to escape that data when rendering it back into HTML output.

Because the vulnerable surface is an HTML attribute (id), the attack primitive is attribute-context injection. When a parameter value is written into an attribute without encoding, an attacker who can control that value may terminate the attribute and inject additional markup or script. The NVD description does not disclose the exact request parameter name, the specific function or class performing the rendering, or the endpoint path; consequently this report deliberately avoids naming any implementation identifiers beyond the id attribute that appears verbatim in the advisory.

Two design properties elevate the practical risk:

1. Persistent execution — The payload is stored server-side and served to every subsequent viewer of the affected page, so a single injection can affect many users over time without further attacker interaction.
2. Low privilege requirement — The advisory states that contributor-level access and above is sufficient. WordPress contributor accounts are commonly granted to external authors, guest bloggers, and lower-trust editorial staff, which materially widens the insider and compromised-account threat surface compared to administrator-only vulnerabilities.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N describes a network-reachable, low-complexity issue requiring low privileges, with no user interaction required for the attacker's own action. The S:C (Scope: Changed) component indicates that exploitation can affect resources beyond the vulnerable component's security authority — consistent with script execution escaping the plugin context into the broader WordPress site origin. Confidentiality and Integrity are both rated Low, and Availability is rated None, reflecting that data theft and page tampering are possible but no direct denial of service results.

Exploitation Scenarios

No public proof-of-concept, exploitation code, or Nuclei template is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (stored XSS via an unsanitized id attribute) and the affected-product context. No specific function names, endpoints, or parameter names beyond the id attribute are asserted, because the advisory does not provide them.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Data Tables Generator by Supsystic plugin at a version at or below 1.12.03. This can be performed with web crawlers that fingerprint plugin assets, Shodan queries against pages containing plugin markers, or by generating a directory listing of installed plugins. The attacker confirms that the target permits user registration or otherwise hosts accounts at contributor level or above — the minimum privilege the advisory states is required.

2. Privilege establishment. Using a contributor-level account (self-registered, provisioned for content authoring, or obtained via credential stuffing/phishing of an existing low-privilege editor), the attacker gains the authenticated access needed to create or edit content that feeds the plugin's data table functionality.

3. Injection of the stored payload. The attacker supplies a crafted value into the plugin's id attribute input path. Because the plugin neither sanitizes the value on input nor escapes it on output, the stored value is later emitted verbatim into the page's HTML. At the vulnerability-class level, a typical attribute-context breakout payload would close the id attribute (for example by supplying a value containing a quote character) followed by an event handler or a <script> element. The exact payload shape is not disclosed in the advisory and should be validated in a controlled lab against the specific plugin version.

4. Payload persistence and delivery. The tainted value is committed to the database. When any user — including administrators or higher-privileged editors — browses the page where the table is rendered, the browser parses the injected markup and executes the attacker's script in the origin of the vulnerable site.

5. Post-exploitation impact. Executed script runs with the victim's authenticated session context. Realistic outcomes include theft of session cookies or authentication tokens, silent creation of new administrative users via CSRF-style state-changing requests, exfiltration of page content and form data, redirection to credential-harvesting pages, and delivery of further browser-side malware. Because the payload executes site-wide for all viewers, a single injection can escalate from a low-privilege contributor foothold toward full site compromise over time.

Impact Assessment

The business impact of CVE-2026-14877 centers on integrity and confidentiality of the WordPress installation and its user base:

• Session and account compromise. Because script executes in the site's origin, session cookies and authentication tokens can be stolen, enabling full account takeover of any user who views the infected page — including administrators.
• Privilege escalation path. A contributor-level attacker converting into an administrator represents a material escalation across the trust boundary, which is reflected in the CVSS Scope metric (S:C).
• Content integrity and reputational damage. Injected content can deface pages, insert malicious redirects, or serve phishing forms indistinguishable from legitimate UI, damaging user trust.
• Blast radius. Any WordPress site hosting the plugin at or below version 1.12.03, with at least one account at contributor level or above, is potentially exploitable. Sites that permit open contributor registration are at higher risk. Because the vulnerability is persistent, every visitor to an infected page is a potential victim, meaning the affected population includes unauthenticated site visitors, not only authenticated users.
• CVSS subscore context. AV:N and AC:L mean no special access or complex conditions are needed at the network level. PR:L reflects the contributor requirement. UI:N indicates the attacker needs no victim interaction to plant the payload (victim interaction occurs only at view time). C:L and I:L cap direct data impact at partial disclosure/tampering, and A:N indicates no direct availability loss.

No active exploitation in the wild has been reported, and no CISA KEV entry exists for this CVE. EPSS scoring is not yet available from FIRST.org, so probabilistic exploitation forecasting is not possible at this time.

Detection Guidance

Sigma Rule

title: Stored XSS Payload Injection via Data Tables Generator id Attribute
id: 9a1f2c3d-4b5e-6f70-8a91-b2c3d4e5f601
status: experimental
description: Detects HTTP requests attempting to inject script content into the id attribute of the Data Tables Generator by Supsystic plugin (CVE-2026-14877).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14877
author: Valters IT Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method|in:
      - 'POST'
      - 'PUT'
  selection_uri:
    cs-uri-query|contains:
      - 'data-tables-generator'
      - 'supsystic'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'onmouseover='
      - 'javascript:'
      - '"%20on'
  condition: selection_method and selection_uri and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-User-Agent
falsepositives:
  - Legitimate content authors inserting code samples in documentation
level: medium
tags:
  - attack.t1190
  - cve.2026-14877

YARA Rule

rule CVE_2026_14877_Supsystic_Stored_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting the id attribute of Data Tables Generator by Supsystic (CVE-2026-14877)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-14877"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin = "data-tables-generator-by-supsystic" ascii wide nocase
        $supsystic = "supsystic" ascii wide nocase
        $attr = "id=" ascii wide nocase
        $xss1 = "<script" ascii wide nocase
        $xss2 = "onerror=" ascii wide nocase
        $xss3 = "onload=" ascii wide nocase
        $xss4 = "onmouseover=" ascii wide nocase
        $xss5 = "javascript:" ascii wide nocase
        $xss6 = "document.cookie" ascii wide nocase

    condition:
        $plugin and $attr and 1 of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14877 Data Tables Generator by Supsystic Stored XSS Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"data-tables-generator"; nocase; http.uri; content:"supsystic"; nocase; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; reference:cve,2026-14877; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-14877; classtype:web-application-attack; sid:202614877; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.action == "network" and
      url.query : ("*data-tables-generator*" or "*supsystic*") and
      http.request.method in ("POST", "PUT") ]
  [ network where event.action == "network" and
      (url.query : "*<script*" or
       url.query : "*onerror=*" or
       url.query : "*onload=*" or
       url.query : "*onmouseover=*" or
       url.query : "*javascript:*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=apache:access
| eval uri=lower(uri)
| where match(uri, "data-tables-generator|supsystic")
| where match(uri, "(?i)(%3cscript|<script|onerror=|onload=|onmouseover=|javascript:|document\.cookie)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,xss,cve-2026-14877,">
  <rule id="202614877" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>data-tables-generator|supsystic</url>
    <regex type="pcre2">(?i)(%3cscript|&lt;script|onerror=|onload=|onmouseover=|javascript:|document\.cookie)</regex>
    <description>CVE-2026-14877: Possible stored XSS injection targeting Data Tables Generator by Supsystic (id attribute)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) indicates a patch is available, but no fixed version string has been published and the fix has not been independently confirmed. Treat all versions up to and including 1.12.03 as vulnerable until the vendor publishes an explicit fixed release.

1. Immediate mitigations (interim, while patch status is unverified):

   • Deploy a Web Application Firewall (WAF) or reverse-proxy with rules that block script tags and JavaScript event-handler syntax in requests to the plugin's endpoints.
   • Reduce the population of accounts with contributor-level or higher privileges to the minimum required; audit and remove unnecessary contributor accounts.
   • Disable open public registration / restrict contributor role assignment if the site does not require it.
   • Consider temporarily deactivating the Data Tables Generator by Supsystic plugin if it is not business-critical, until a confirmed fixed version is available.
   • Apply Content Security Policy (CSP) headers to limit inline script execution as a defense-in-depth control.

2. Patch / upgrade steps:

   • Monitor the plugin vendor's official release channel and the NVD entry for CVE-2026-14877 for the publication of a fixed version identifier.
   • Once a fixed version is published and independently verified, upgrade all instances immediately using the WordPress plugin update mechanism or by deploying the verified package through your configuration management pipeline.
   • Validate the upgrade by confirming the installed version and by re-testing the id attribute input path in a staging environment.

3. Long-term hardening:

   • Enforce least-privilege role design in WordPress; periodically review all accounts with content-creation rights.
   • Maintain an inventory of installed plugins and a subscription to vulnerability feeds for timely patch deployment.
   • Enforce consistent output encoding (attribute-context escaping) across all custom and third-party plugin rendering paths as an architectural standard.
   • Implement logging and alerting for content-modification events by low-privilege users to catch stored-XSS injection attempts early.

References

• NVD — CVE-2026-14877: https://nvd.nist.gov/vuln/detail/CVE-2026-14877
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WordPress Plugin Security Best Practices / Hardening Guidance: https://developer.wordpress.org/plugins/security/
• FIRST EPSS (no score currently available for this CVE): https://api.first.org/data/v1/epss?cve=CVE-2026-14877

Note: No public proof-of-concept, exploit code, or Nuclei template has been observed. No threat actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing, and no CISA KEV entry exists.