Vulnerability in WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards — CVE-2026-120479

What to do now

Update WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards to 5.5.91 or later.

Affected versions

• Everything up to and including 5.5.90

The WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Data Projects front-end simple form in versions up to, and including, 5.5.90 This is due to insufficient input sanitization and output escaping on the value of TEXT/TINYTEXT/MEDIUMTEXT/LONGTEXT columns rendered by the WPDA_Simple_Form_Item_Textarea::show_item() method, which emits the stored column value directly inside a <textarea> element after only replacing '&' with '&amp;'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This description is reproduced verbatim from the public vulnerability record.

• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form.php#L518
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Data.php#L158
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Item.php#L478
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/WPDataAccess/Simple_Form/WPDA_Simple_Form_Item_Textarea.php#L22
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.90/public/class-wp-data-access-public.php#L441
• https://plugins.trac.wordpress.org/browser/wp-data-access/tags/5.5.91

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.