WordPress plugin
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical0
- High9
- Medium18
- Low0
All WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerabilities
- Medium4.3Cross-Site Request Forgery
≤5.5.90Update to 5.5.91
- High8.1Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert
≤5.5.89Update to 5.5.90
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer
≤5.5.89Update to 5.5.90
- Medium5.3Authenticated (Subscriber+) SQL Injection via 'engine' Parameter
≤5.5.90Update to 5.5.91
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form
≤5.5.90Update to 5.5.91
- Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label
≤5.5.89Update to 5.5.90
- Medium5.9Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
≤5.5.88Update to 5.5.89
- Medium6.4Authenticated (Subscriber+) Server-Side Request Forgery
≤5.5.87Update to 5.5.88
- Medium5.3Missing Authorization
<5.5.77Update to 5.5.77
- Medium5.3Unauthenticated Information Exposure
<5.5.84Update to 5.5.84
- High7.5Unauthenticated SQL Injection
≤5.5.82Update to 5.5.83
- High7.5Unauthenticated SQL Injection
≤5.5.84Update to 5.5.85
- High7.5Unauthenticated SQL Injection
≤5.5.81Update to 5.5.82
- Medium5.3Unauthenticated Insecure Direct Object Reference to Data Access
≤5.5.68Update to 5.5.69
- Medium5.3Missing Authorization
≤5.5.80Update to 5.5.81
- Medium6.4Authenticated (Author+) Stored Cross-Site Scripting
≤5.5.79Update to 5.5.80
- High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.79Update to 5.5.80
- Medium5.3Missing Authorization
≤5.5.78Update to 5.5.79
- High7.5Unauthenticated SQL Injection
≤5.5.70Update to 5.5.71
- Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
≤5.5.8Update to 5.5.9
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode
≤5.5.63Update to 5.5.64
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.5.36Update to 5.5.37
- High7.5Unauthenticated SQL Injection
≤5.5.22Update to 5.5.23
- Medium4.3Cross-Site Request Forgery
≤5.5.7Update to 5.5.9
- High7.5Authenticated (Subscriber+) Privilege Escalation
≤5.3.7Update to 5.3.8
- Medium6.3Missing Authorization Checks
all versionsNo patch available
- High7.2Admin+ SQL Injection
≤4.3.1Update to 5.0.0
WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: common questions
Does WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps have known vulnerabilities?
Yes. VulnCrest Radar lists 27 known vulnerabilities in WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps: 9 high, 18 medium. At least one is not fixed in the latest version.
How do I check which version of WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerability?
CVE-2026-121783, published Nov 7, 2026: WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps <= 5.5.90 - Cross-Site Request Forgery. Severity: Medium (CVSS 4.3).
Is any WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerability listed in CISA KEV?
No. None of the known WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps vulnerabilities is currently listed in the CISA KEV catalog.