Is CVE-2026-118204 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118204 being exploited in the wild.

How severe is CVE-2026-118204?

Medium severity, with a CVSS score of 6.4, published 7 November 2026.

Which products and versions are affected?

WordPress.org WP Data Access up to and including 5.5.89.

Is there a fix for CVE-2026-118204?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-118204 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118204?

Check whether you run WordPress.org WP Data Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118204: WP Data Access stored cross-site scripting in image URL column

CVE-2026-118204 · Severity: medium · CVSS 6.4 · Published 2026-11-07

WP Data Access is a WordPress plugin that allows administrators to build database-driven tables, forms, and dashboards without coding. A flaw in how the plugin handles image URL columns lets authenticated attackers inject malicious scripts that execute when other users view affected pages, potentially compromising their sessions or stealing sensitive information.

Vendors: WordPress.org.

Quick answers

Is CVE-2026-118204 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118204 being exploited in the wild.
How severe is CVE-2026-118204?: Medium severity, with a CVSS score of 6.4, published 7 November 2026.
Which products and versions are affected?: WordPress.org WP Data Access up to and including 5.5.89.
Is there a fix for CVE-2026-118204?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-118204 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118204?: Check whether you run WordPress.org WP Data Access at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored XSS vulnerability exists in the plugin's DataTables feature due to insufficient input sanitization and output escaping of the Image URL column parameter (derived from wp_usermeta.description). An authenticated subscriber-level attacker can inject arbitrary JavaScript into database columns that an administrator has configured to display as Image URLs in a published DataTables shortcode; the script will execute in the browsers of all users viewing the affected page. This requires non-default configuration: the administrator must have explicitly enabled Image URL media type for the vulnerable column.

Affected products

Wordpress.org WP Data Access up to and including 5.5.89

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.