# CVE-2026-57672: Melograno Venture Studio wpDataTables unauthenticated XSS

Source: https://junglewise.ai/threats/cve-2026-57672-melograno-venture-studio-wpdatatables-unauthenticated-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-57672 · Severity: high · CVSS 7.1 · Published 2026-07-02

wpDataTables is a popular WordPress plugin used to create and manage complex tables and charts. A security flaw allows unauthenticated attackers to inject malicious scripts into the website, which are then executed in the browsers of other visitors. This could lead to unauthorized actions being performed on behalf of site administrators, theft of session information, or redirection of users to malicious websites.

## Quick answers

**Is CVE-2026-57672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57672 being exploited in the wild.

**How severe is CVE-2026-57672?** High severity, with a CVSS score of 7.1, published 2 July 2026.

**Which products and versions are affected?** Melograno Venture Studio wpDataTables <= 6.5.1.1.

**Is there a fix for CVE-2026-57672?** A patch was published on 2026-06-30: Version 6.5.1.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57672 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57672?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the wpDataTables plugin for WordPress (versions 6.5.1.1 and below) due to improper neutralization of user-supplied input (CWE-79). The flaw allows an unauthenticated remote attacker to inject arbitrary web scripts. While the attack is unauthenticated, successful exploitation requires user interaction, typically from a privileged user (e.g., an administrator) clicking a malicious link or viewing a specific page. If successful, the attacker can execute scripts in the context of the victim's browser session, potentially leading to session hijacking or site defacement. The issue is resolved in version 6.5.1.2.

## Affected products

- Melograno Venture Studio wpDataTables <= 6.5.1.1

## Timeline

- 2026-06-22: disclosed: Reported by Nguyen Ba Khanh
- 2026-06-30: advisory: Patchstack published advisory
- 2026-07-02: advisory: NVD published CVE-2026-57672
- 2026-06-30: patched: Version 6.5.1.2 released

## References

- [https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-5-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/wpdatatables/vulnerability/wordpress-wpdatatables-plugin-6-5-1-1-cross-site-scripting-xss-vulnerability?_s_id=cve)