CVE-2026-96648

Executive Summary

CVE-2026-96648 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Data Tables Generator by Supsystic, affecting all versions up to and including 1.15.1. The flaw resides in the plugin's updateRows action handler, where a table cell 'data' value is neither sufficiently sanitized on input nor escaped on output. Authenticated attackers with Subscriber-level access or above can inject arbitrary JavaScript that executes in the browser of any user viewing the affected page — provided an administrator has added the attacker's role to the plugin's access_roles setting. No public proof-of-concept, Nuclei template, or CISA KEV listing exists at this time.

Technical Analysis

The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue manifesting as stored XSS. WordPress plugins frequently expose AJAX handlers via the wp_ajax_* and wp_ajax_nopriv_* hooks. The updateRows action referenced here is one such handler registered by the Data Tables Generator plugin. It accepts row data — including a 'data' value for individual table cells — and persists it to the database that backs the generated data table.

The root cause has two components, both explicitly stated in the NVD description:

1. Insufficient input sanitization — the updateRows handler writes attacker-supplied cell content to storage without adequately stripping or encoding HTML/JavaScript.
2. Insufficient output escaping — the stored cell content is later rendered into a page without context-appropriate escaping, allowing the injected markup and script to execute in the victim's browser.

Access control is governed by the plugin's access_roles setting. By default this is an administrative configuration; however, the plugin explicitly supports granting lower-privileged roles (e.g., Subscriber) access. When an administrator adds a low-privilege role to access_roles, members of that role receive the dtgs_nonce required to authenticate to the updateRows handler. Because the handler treats the nonce check as sufficient authorization, a Subscriber can then submit malicious cell data.

The CVSS 3.1 vector — AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N — yields a base score of 6.4. Notable elements:

• PR:L (Low privileges required): the attacker needs an authenticated account, which is satisfied by Subscriber-level access when access_roles is configured.
• UI:N (No user interaction): the injected script executes automatically when a victim loads the injected page — no click is required.
• S:C (Scope Changed): the vulnerable component (the plugin's data-handling code) can affect resources beyond its security scope — specifically, the execution context of users viewing the page, including administrators.
• C:L / I:L / A:N: limited confidentiality and integrity impact (sessions, cookies, page content), no availability impact.

Because the CVSS vector contains PR:L, unauthenticated remote attackers cannot exploit this directly; the attack surface is limited to authenticated users whose role has been granted plugin access.

Exploitation Scenarios

No public PoC or exploit code is available for this CVE. The attack chain below is inferred strictly from the vulnerability class (stored XSS via an authenticated plugin AJAX action) and the details provided in the NVD description. No specific function names, endpoints, or parameter structures beyond those named in the description are asserted.

Step 1 — Reconnaissance / target identification. The attacker identifies WordPress sites running Data Tables Generator by Supsystic at version <= 1.15.1. Fingerprinting is achievable via plugin asset paths in page source (e.g., wp-content/plugins/data-tables-generator-by-supsystic). The attacker must determine whether the target site has configured the access_roles setting to include a low-privilege role, which is a prerequisite for Subscriber-level exploitation.

Step 2 — Authentication and privilege acquisition. The attacker registers or obtains a WordPress account. If the site grants the attacker's role (e.g., Subscriber) access via access_roles, the attacker can retrieve the dtgs_nonce and reach the updateRows action handler. If access_roles does not include a low-privilege role, the attacker must obtain an account with a role that is listed.

Step 3 — Payload submission. Using the authorized dtgs_nonce, the attacker submits a request to the plugin's updateRows action containing a table cell 'data' value crafted as an XSS payload. Because input sanitization is insufficient, the payload is persisted to the underlying data table storage. No specific payload syntax is prescribed here; any script-bearing value capable of surviving the plugin's (inadequate) input handling would be stored.

Step 4 — Execution and post-exploitation impact. When any user — including an administrator — accesses a page rendering the injected data table, the stored script executes in that user's browser session context. Because no user interaction is required (UI:N), execution is automatic. Impact is bounded to limited confidentiality and integrity per CVSS (C:L/I:L/A:N), but the changed scope (S:C) means the script runs with the privileges of the viewing user's session. Realistic outcomes include session token theft, credential harvesting via injected forms, arbitrary actions performed as the victim, and drive-by redirection — all consistent with stored XSS. The exact post-exploitation behavior depends entirely on the attacker's payload.

It is important to note the practical limitation: Subscriber-level exploitation only works when an administrator has explicitly opted in by adding the Subscriber role to access_roles. This is a documented and supported plugin feature, not a misconfiguration — making the vulnerable configuration reachable through normal plugin use rather than administrator error alone.

Impact Assessment

The blast radius of CVE-2026-96648 depends on the site's access_roles configuration and the roles of users who view affected pages.

• Confidentiality (C:L): Injected scripts can read page content and, depending on cookie flags, potentially access session tokens or other data exposed to JavaScript in the viewing user's context.
• Integrity (I:L): Scripts can modify page content, submit requests as the victim, or alter displayed data — limited in scope but real.
• Availability (A:N): No direct availability impact is described.
• Scope (S:C): The most consequential subscore. The vulnerable component affects the security scope of the users viewing the page. If an administrator views an injected table, the script runs in an administrative session context, potentially enabling privilege escalation within the WordPress site.
• Attack Vector (AV:N): Exploitable over the network.
• Attack Complexity (AC:L): No special conditions beyond the access_roles prerequisite.
• Privileges Required (PR:L): Authenticated access needed; Subscriber is sufficient when configured.
• User Interaction (UI:N): Execution is automatic on page view.

Business impact includes potential takeover of administrative WordPress sessions, defacement or data manipulation of published tables, credential theft from site visitors or staff, and reputational damage. Sites that have not granted Subscriber-level access via access_roles reduce their exposure but do not eliminate the underlying stored XSS flaw — users with an approved role remain attack vectors.

Detection Guidance

Sigma Rule

title: Data Tables Generator by Supsystic Stored XSS via updateRows Action
id: 5b2f9c1e-9664-48aa-9c0a-000000000001
status: experimental
description: Detects HTTP requests invoking the Data Tables Generator updateRows action with script-bearing cell data, consistent with CVE-2026-96648 stored XSS.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-96648
author: valtersit.com
date: 2026-01-01
logsource:
    category: webserver
detection:
    selection_action:
        cs-uri-query|contains: 'action=updateRows'
    selection_payload:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
            - '<img'
            - '<svg'
    condition: selection_action and selection_payload
falsepositives:
    - Legitimate use of HTML in table cells by trusted editors
    - Security scanners and fuzzers
level: medium
tags:
    - attack.t1059
    - cwe.79

YARA Rule

rule CVE_2026_96648_DTGS_UpdateRows_XSS
{
    meta:
        description = "Detects script-bearing payloads associated with Data Tables Generator updateRows stored XSS (CVE-2026-96648)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96648"
        date = "2026-01-01"

    strings:
        $action = "updateRows" ascii nocase
        $plugin = "data-tables-generator-by-supsystic" ascii nocase
        $nonce  = "dtgs_nonce" ascii nocase
        $xss1   = "<script" ascii nocase
        $xss2   = "onerror=" ascii nocase
        $xss3   = "javascript:" ascii nocase
        $xss4   = "onload=" ascii nocase

    condition:
        ($plugin or $nonce or $action) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96648 Data Tables Generator updateRows Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"action=updateRows"; nocase; http.client_body; content:"<script"; nocase; http.client_body; content:"onerror="; nocase; classtype:web-application-attack; reference:cve,2026-96648; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96648; sid:202696648; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      url.query contains "action=updateRows" ]
  [ network where http.request.method == "POST" and
      http.request.body.content regex """.*(<script|onerror=|onload=|javascript:).*""" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search "action=updateRows"
| regex _raw="(?i)(<script|onerror=|onload=|javascript:)"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as uris values(clientip) as src_ips
        by clientip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-96648,">
  <rule id="20269664" level="10">
    <if_sid>31100</if_sid>
    <match>action=updateRows</match>
    <regex type="pcre2">(?i)(&lt;script|onerror=|onload=|javascript:)</regex>
    <description>CVE-2026-96648: Possible Data Tables Generator updateRows stored XSS attempt</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_96648,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (NVD) claims a patch exists, but it has not been independently confirmed, and no vendor fix version has been published. Treat remediation as unverified and validate any upgrade against official vendor channels.

1) Immediate mitigations

• Review the plugin's access_roles setting and remove any low-privilege roles (e.g., Subscriber) that are not strictly necessary. Note that the NVD description states Subscriber-level exploitation only applies when an administrator has added that role to access_roles.
• Restrict account registration and review accounts holding the lowest roles on the site.
• If the plugin is not required, deactivate and remove it.
• Deploy WAF rules targeting the updateRows action and script-bearing cell data, consistent with the signatures above.
• Apply CSP headers to limit the impact of any injected scripts, where feasible.

2) Patch / upgrade steps

• Verify the current installed version of Data Tables Generator by Supsystic. All versions up to and including 1.15.1 are affected per NVD.
• Monitor the vendor's official distribution channel (WordPress.org plugin repository and Supsystic's site) for a patched release. Because the patch is only CLAIMED and no fixed version has been published (Affected Versions list is empty and Vendor Fix is N/A), do not assume a specific patched version exists.
• When a patched version is released, back up the site, stage the upgrade, and verify the updateRows handler behavior before production rollout.

3) Long-term hardening

• Enforce the principle of least privilege on WordPress roles and avoid granting plugin administrative capabilities to low-privilege accounts.
• Adopt input validation and output encoding requirements for all plugin and theme code; ensure cell data is HTML-encoded on output.
• Maintain a plugin inventory and subscribe to vulnerability feeds for WordPress components.
• Implement continuous monitoring for stored XSS through content and log analysis, and periodically audit rendered tables for injected markup.

References

• NVD — CVE-2026-96648: https://nvd.nist.gov/vuln/detail/CVE-2026-96648
• MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress.org Plugin Directory — Data Tables Generator by Supsystic: https://wordpress.org/plugins/data-tables-generator-by-supsystic/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS — not yet scored for this CVE: https://www.first.org/epss/

No public PoC, exploit code, Nuclei template, or CISA KEV entry is associated with this CVE as of this report. No threat actor campaigns or in-the-wild exploitation evidence have been identified.