# WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps

> Turn your data into WordPress apps. No code required. Tables, forms, dashboards, charts, maps, optional hooks for developers, 35+ languages.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 09:31 UTC.

## Facts (WordPress.org)

- Slug: `wp-data-access`
- Author: Passionate Programmer Peter
- Version: 5.5.93
- Active installs: 10,000+
- Last update: 2026-11-13 (today)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress any, PHP 7.4
- Tags: app builder, dashboard, data table, datatable, Table Builder
- Page: https://wordpress.org/plugins/wp-data-access/

## Checks (against WordPress 7.1.4)

- OK: Updated today.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Slows pages ↔ Speeds up, English only ↔ Translation-ready, Inaccessible ↔ Accessible, Locked in ↔ Portable, Breaking ↔ Smooth.

## Known vulnerabilities

- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via Autocomplete Lookup Label (up to 5.5.89). CVE-2026-118048, https://www.wordfence.com/threat-intel/vulnerabilities/id/25cf5cf7-d846-4f0e-aa6b-bbf7dba27b10?source=api-prod
- 2026-11-06 MEDIUM: Authenticated (Subscriber+) SQL Injection via 'engine' Parameter (up to 5.5.90). CVE-2026-121536, https://www.wordfence.com/threat-intel/vulnerabilities/id/564eeb3a-13e6-426d-a346-e2d85e88846c?source=api-prod
- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Image URL' Media-Type Column Renderer (up to 5.5.89). CVE-2026-118204, https://www.wordfence.com/threat-intel/vulnerabilities/id/64fedaf1-3edf-43e9-8521-95a5efa1c8f4?source=api-prod
- 2026-11-06 MEDIUM: Authenticated (Subscriber+) Stored Cross-Site Scripting via TEXT-family Column Value in Front-end Data Project Form (up to 5.5.90). CVE-2026-120479, https://www.wordfence.com/threat-intel/vulnerabilities/id/980387d1-dd16-405d-8af2-fb7fb8b926db?source=api-prod
- 2026-11-06 HIGH: Incorrect Authorization to Unauthenticated Privilege Escalation via 'key' and 'val' Parameters on app/update, app/delete, app/insert (up to 5.5.89). CVE-2026-118267, https://www.wordfence.com/threat-intel/vulnerabilities/id/a81029fe-db29-4dd4-8450-65d1764855f1?source=api-prod
- 2026-10-31 MEDIUM: Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter (up to 5.5.88). CVE-2026-110023, https://www.wordfence.com/threat-intel/vulnerabilities/id/36ffa22b-43d0-48aa-8147-db0a9c49a7b9?source=api-prod
- 2026-10-17 MEDIUM: Authenticated (Subscriber+) Server-Side Request Forgery (up to 5.5.87). CVE-2026-106470, https://www.wordfence.com/threat-intel/vulnerabilities/id/05b9b37e-8295-42c3-8641-0689aa2ccbb4?source=api-prod
- 2026-10-14 MEDIUM: Missing Authorization (before 5.5.77). CVE-2026-106098, https://www.wordfence.com/threat-intel/vulnerabilities/id/459744db-d44a-480d-b05a-27c253bc358c?source=api-prod
- 2026-10-14 MEDIUM: Unauthenticated Information Exposure (before 5.5.84). CVE-2026-106099, https://www.wordfence.com/threat-intel/vulnerabilities/id/2460058f-8cc5-416d-aac2-24a4a62d1c99?source=api-prod
- 2026-10-07 HIGH: Unauthenticated SQL Injection (up to 5.5.82). CVE-2026-95605, https://www.wordfence.com/threat-intel/vulnerabilities/id/bbbf3d43-69df-4beb-963d-5c483486cfeb?source=api-prod
- 2026-09-30 HIGH: Unauthenticated SQL Injection (up to 5.5.84). CVE-2026-93621, https://www.wordfence.com/threat-intel/vulnerabilities/id/a756f7cd-d44a-49b6-af60-5f85d82c3ade?source=api-prod
- 2026-08-31 HIGH: Unauthenticated SQL Injection (up to 5.5.81). CVE-2026-81293, https://www.wordfence.com/threat-intel/vulnerabilities/id/0ddf73e1-cd45-45f7-9635-eb4052d34f67?source=api-prod
- 2026-08-26 MEDIUM: Unauthenticated Insecure Direct Object Reference to Data Access (up to 5.5.68). CVE-2026-3235, https://www.wordfence.com/threat-intel/vulnerabilities/id/935f5d76-d63a-4db4-b645-b7961ae8bfaf?source=api-prod
- 2026-08-20 MEDIUM: Missing Authorization (up to 5.5.80). CVE-2026-66595, https://www.wordfence.com/threat-intel/vulnerabilities/id/84878b9c-c13c-44d5-a39d-6befd51a14ff?source=api-prod
- 2026-08-13 MEDIUM: Authenticated (Author+) Stored Cross-Site Scripting (up to 5.5.79). CVE-2026-73344, https://www.wordfence.com/threat-intel/vulnerabilities/id/d112f1b0-bfe0-44f0-b43a-334976bdb114?source=api-prod
- 2026-08-09 MEDIUM: Missing Authorization (up to 5.5.78). CVE-2026-18032, https://www.wordfence.com/threat-intel/vulnerabilities/id/f2122fa2-0500-4c4e-aec5-eb440e8cc585?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 5.5.79). CVE-2026-66663, https://www.wordfence.com/threat-intel/vulnerabilities/id/e5aab86a-0fcd-4192-a5db-5da1b68e366a?source=api-prod
- 2026-06-15 HIGH: Unauthenticated SQL Injection (up to 5.5.70). CVE-2026-42665, https://www.wordfence.com/threat-intel/vulnerabilities/id/53ee7062-85f9-4d12-a432-f373fc25bab6?source=api-prod
- 2026-04-30 MEDIUM: Reflected DOM-Based Cross-Site Scripting via url Parameter (up to 5.5.31). WF-d694491c-c0f5-4418-805a-db792ea4f712-101, https://www.wordfence.com/threat-intel/vulnerabilities/id/d694491c-c0f5-4418-805a-db792ea4f712?source=api-prod
- 2026-02-13 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode (up to 5.5.63). CVE-2026-0557, https://www.wordfence.com/threat-intel/vulnerabilities/id/97ddb0e9-1bb8-48ed-9fa3-d2b5f260263b?source=api-prod
- 2025-04-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (up to 5.5.36). CVE-2025-39582, https://www.wordfence.com/threat-intel/vulnerabilities/id/e8260829-49a6-4ec0-8771-25d1cce8cc8c?source=api-prod
- 2024-12-24 HIGH: Unauthenticated SQL Injection (up to 5.5.22). CVE-2024-12428, https://www.wordfence.com/threat-intel/vulnerabilities/id/a1708d6e-14f5-418f-81eb-f9269159b5b1?source=api-prod
- 2024-08-16 MEDIUM: Cross-Site Request Forgery (up to 5.5.7). CVE-2024-43295, https://www.wordfence.com/threat-intel/vulnerabilities/id/85a33508-71f2-4aa1-8d51-667eb0690fbd?source=api-prod
- 2023-04-06 HIGH: Authenticated (Subscriber+) Privilege Escalation (up to 5.3.7). CVE-2023-1874, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f562e33-2aef-46f0-8a65-691155ede9e7?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 5.1.4). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-463, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod
- 2021-11-08 HIGH: Admin+ SQL Injection (up to 4.3.1). CVE-2021-24866, https://www.wordfence.com/threat-intel/vulnerabilities/id/7cb9cc24-920f-402d-8a87-8b6c6a1b1a51?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-data-access · HTML: https://todaywp.com/plugins/wp-data-access