CVE-2026-14877 supsysticcom CVE debrief

Who should care

WordPress administrators, security teams, and users with contributor-level access or higher should assess exposure and prioritize remediation. Affected operators and platforms should review and verify affected scope, severity, and vendor guidance. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

CVE-2026-14877 is a Stored Cross-Site Scripting vulnerability in the Data Tables Generator by Supsystic plugin for WordPress. Authenticated attackers with contributor-level access can inject malicious scripts, which can execute on page access. WordPress administrators and security teams should assess exposure and prioritize remediation.

• Attackers can inject arbitrary web scripts, potentially leading to malicious actions.
• Compromised pages can execute malicious scripts, affecting users who access them.
• Remediation priority is high for WordPress installations with contributor-level access or higher.
• Verification of affected versions and exposure is necessary.

Technical summary

The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03. An authenticated attacker with contributor-level access and above can inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability exists due to insufficient input sanitization and output escaping. This allows attackers to inject malicious scripts, potentially leading to malicious actions on compromised pages that execute the scripts.

Defensive priority

Assess exposure and prioritize remediation for WordPress installations using the Data Tables Generator by Supsystic plugin, especially those with contributor-level access or higher.

Recommended defensive actions

• Assess exposure by checking if the Data Tables Generator by Supsystic plugin is installed and if the version is 1.12.03 or lower.
• Prioritize remediation for WordPress installations with contributor-level access or higher.
• Monitor for suspicious activity related to the plugin.
• Consider implementing additional security measures, such as input validation and output escaping, for user-generated content.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. The Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the id attribute in all versions up to, and including, 1.12.03 due to insufficient input sanitization and output escaping. Evidence is limited to public CVE details and source item information. Defenders should verify affected versions, assess exposure, and prioritize remediation for WordPress with

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.