PLUGIN SECURITY
Is Wpdatatables safe?
The best WordPress table plugin. Create responsive, and searchable tables and charts from Excel (.xlsx, .xls or .ods), CSV, XML, JSON, and PHP.
What this plugin does
- Slug:
wpdatatables - Author: Melograno Venture Studio
- 70000+ active installs
- 90/100 rating (449 reviews on wordpress.org)
- 2728852 all-time downloads
- On WordPress.org since 2015-11-30
chartcsvdatatabletableTable Builder
Maintenance status
- Latest known version: 6.5.1.4
- Last updated: 2026-08-17 6:15am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): <8.0
Known vulnerabilities
23 known CVEs on file for Wpdatatables. Reported between 2014 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-66597 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.1.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.5.1.5 | 6.5.1.5 | 2026-08-20 | ⚠ update needed |
| CVE-2026-57672 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.1.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 6.5.1.2 | 6.5.1.2 | 2026-06-30 | ✓ fixed in latest |
| CVE-2026-65509 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 7.5.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 7.5.2 | 7.5.2 | 2026-06-30 | ⚠ update needed |
| CVE-2026-54825 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 7.4.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 7.4.1 | 7.4.1 | 2026-06-17 | ⚠ update needed |
| CVE-2026-49080 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 7.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.3 | < 7.4 | 7.4 | 2026-06-08 | ⚠ update needed |
| CVE-2026-5721 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 6.5.0.5 | 6.5.0.5 | 2026-04-20 | ✓ fixed in latest |
| CVE-2026-28039 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.5.0.2 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | High 7.5 | < 6.5.0.2 | 6.5.0.2 | 2026-03-03 | ✓ fixed in latest |
| CVE-2024-3820 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.3.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 10.0 | < 6.3.2 | 6.3.2 | 2024-05-31 | ✓ fixed in latest |
+ 22 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2024-3821 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 6.4 | Missing Authorization | High 7.3 | < 6.4 | 6.4 | 2024-05-31 | ✓ fixed in latest |
| CVE-2024-4895 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2.14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 3.4.2.14 | 3.4.2.14 | 2024-05-22 | ✓ fixed in latest |
| CVE-2024-0591 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.4.2.5 | 3.4.2.5 | 2024-02-20 | ✓ fixed in latest |
| — | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.1.66 | — | Unknown | < 2.1.66 | 2.1.66 | 2023-08-18 | ✓ fixed in latest |
| CVE-2023-4314 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.1.66 | Deserialization of Untrusted Data | High 7.2 | < 2.1.66 | 2.1.66 | 2023-08-16 | ✓ fixed in latest |
| CVE-2023-23876 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.1.50 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 2.1.50 | 2.1.50 | 2023-02-20 | ✓ fixed in latest |
| CVE-2022-29432 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.1.28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.4 | < 2.1.28 | 2.1.28 | 2022-05-06 | ✓ fixed in latest |
| CVE-2022-25618 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.1.28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 2.1.28 | 2.1.28 | 2022-04-04 | ✓ fixed in latest |
| CVE-2021-24197 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2 | Improper Access Control | High 8.1 | < 3.4.2 | 3.4.2 | 2021-03-16 | ✓ fixed in latest |
| CVE-2021-24198 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2 | Improper Access Control | High 8.1 | < 3.4.2 | 3.4.2 | 2021-03-16 | ✓ fixed in latest |
| CVE-2021-24199 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 3.4.2 | 3.4.2 | 2021-03-16 | ✓ fixed in latest |
| CVE-2021-24200 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 3.4.2 | 3.4.2 | 2021-03-16 | ✓ fixed in latest |
| CVE-2021-26754 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 3.4.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 3.4.1 | 3.4.1 | 2021-02-02 | ✓ fixed in latest |
| CVE-2019-6011, CVE-2019-6012 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.0.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 2.0.12 | 2.0.12 | 2019-10-11 | ✓ fixed in latest |
| CVE-2019-6012 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 2.0.12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 2.0.12 | 2.0.12 | 2019-10-11 | ✓ fixed in latest |
| — | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 1.2.2 | — | Unknown | < 1.2.2 | 1.2.2 | 2016-12-12 | ✓ fixed in latest |
| — | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 1.5.4 | — | Unknown | < 1.5.4 | 1.5.4 | 2014-11-25 | ✓ fixed in latest |
| — | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 1.5.4 | — | Unknown | < 1.5.4 | 1.5.4 | 2014-11-24 | ✓ fixed in latest |
| CVE-2014-9175 | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 1.5.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Unknown | < 1.5.4 | 1.5.4 | 2014-11-23 | ✓ fixed in latest |
| — | wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin [wpdatatables] < 1.5.4 | — | Unknown | < 1.5.4 | 1.5.4 | — | ✓ fixed in latest |
| — | wpDataTables < 1.5.4 - Unauthenticated Shell Upload | — | Unknown | < 1.5.4 | 1.5.4 | — | ✓ fixed in latest |
| CVE-2023-4314 | wpDataTables < 2.1.66 - Admin+ PHP Object Injection | — | Unknown | < 2.1.66 | 2.1.66 | — | ✓ fixed in latest |
How to fix it
Keep Wpdatatables updated — 6.5.1.4 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- TablePress – Tables in WordPress made easy — 600000+ active installs — 100/100 (4625) — max PHP 8.4
- WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets — 100000+ active installs — 94/100 (1962) — max PHP <8.0
- Import and export users and customers — 70000+ active installs — 94/100 (256) — max PHP 8.4
- Export All URLs — 50000+ active installs — 92/100 (94) — max PHP 8.4
- WP Import Export Lite — 40000+ active installs — 80/100 (113)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.