CVE-2026-120479

Vulnerability Description

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping on the value of TEXT/TINYTEXT/MEDIUMTEXT/LONGTEXT columns rendered by the WPDA_Simple_Form_Item_Textarea::show_item() method, which emits the stored column value directly inside a <textarea> element after only replacing '&' with '&amp;'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Score

Related Weaknesses (CWE)

References

• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAcce
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAcce
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAcce
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAcce
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/public/cla
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.91
• https://www.wordfence.com/threat-intel/vulnerabilities/id/980387d1-dd16-405d-8af