CVE-2026-118048

The WP Data Access plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 5.5.89 . The root cause is insufficient output escaping on the value returned by WPDA_Autocomplete::autocomplete_lookup() when it is emitted into a single-quoted HTML attribu...