Wpdatatables is a WordPress plugin providing table creation and data visualization functionality that represents a narrowly scoped but more-prominent-than-typical attack surface in the WordPress ecosystem. The observed vulnerability exposure centers on SQL injection flaws in the plugin's data-handling mechanisms, reflecting risks inherent to dynamic query construction in database-backed WordPress extensions. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wpdatatables over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-54825CRITICAL Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. | Jun 26, 2026 | 9.3 | 38 | NO | NO |
CVE-2021-26754CRITICAL wpDataTables before 3.4.1 mishandles order direction for server-side tables, aka admin-ajax.php?action=get_wdtable order[0][dir] SQL injection. | Feb 8, 2021 | 9.8 | 30 | NO | NO |
CVE-2014-9175HIGH SQL injection vulnerability in wpdatatables.php in the wpDataTables plugin 1.5.3 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the table_i | Dec 2, 2014 | 7.5 | 30 | NO | YES |
CVE-2026-28039HIGH Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpDataTables wpDataTables wpdatatables allows PHP Local Fil | Mar 5, 2026 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wpdatatables.
Media articles that mention a CVE ID that affects a product developed by Wpdatatables — matched by CVE ID, not by vendor name.