Headline

CVE-2022-29432: wpDataTables – Tables & Table Charts

Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 on WordPress via &data-link-text, &data-link-url, &data, &data-shortcode, &data-star-num vulnerable parameters.

2 years ago

CVE

Open in Source

#sql #xss #vulnerability #web #google #js #wordpress #php #pdf #auth #postgres #sap

Details
Reviews
Installation
Support
Development

wpDataTables is a popular WordPress table plugin used to quickly create tables & table charts from Excel, CSV, JSON, PHP and other data sources. Use our WP table plugin to represent vast amounts of complicated data in concise, user-friendly way using tables or charts.

NEW! New table builder is introduced in wpDataTables – creating simple tables from scratch. These tables can be anything but simple, though, as you can now merge cells, style each cell differently, add star ratings to cells, and so much more.

Here is the list of the new functionality in those simple tables:

Merge cells
Excel like editor
Responsive mode
Add/Remove columns and rows
Resize/Reorder columns and rows
Cell custom formatting
Font family and font size
Undo/Redo
Add star rating
Custom links
Add media
Custom HTML
Shortcode in cells
NEW Border options
NEW! Simple table – Text documentation
Excel – Text and video documentation
CSV – Text and video documentation
JSON – Text and video documentation
XML – Text and video documentation
Serialized PHP array – Text and video documentation

wpDataTables allows creating 14 different chart types using the Google Charts rendering engine:

Google Line Chart – Live example
Google Column Chart – Live example
Google Pie Chart – Live example
Google Area Chart – Live example
Google Stepped area Chart – Live example
Google Histogram – Live example
Google Bar Chart – Live example
Google Stacked Bar Chart – Live example
Google Bubble Chart – Live example
Google Donut Chart – Live example
Google Gauge Chart – Live example
Google Scatter Chart – Live example
Google Candlestick Chart – Live example
Google Waterfall Chart – Live example

NEW! And now 9 more chart types with Chart.js engine, that renders simple and flexible charts with a lot of customization options:

Chart.js Line Chart – Live example
Chart.js Column Chart – Live example
Chart.js Area Chart – Live example
Chart.js Stacked area Chart – Live example
Chart.js Radar Chart – Live example
Chart.js Polar Chart – Live example
Chart.js Pie Chart – Live example
Chart.js Doughnut Chart – Live example
Chart.js Bubble Chart – Live example

Creating tables and charts with a WordPress tables plugin has never been easier. It only takes 3 basic steps:

Step 1 – Provide table data

You can provide table data for WordPress tables by uploading Excel, CSV , JSON, XML or Serialized PHP array or you will create simple table from scratch with new table builder.

Step 2 – Customization

You can customize and configure the columns of your WordPress table (rename, reorder, add CSS classes, hide, change colors) and also you can customize and configure table Color and Font settings( Font, Header, Table border, Row , Cell and Pagination) in any way you see fit.

Step 3 – Publish in a post or page

Once you are happy with the design of your WordPress table, you can easily insert it on any post or page through Gutenberg, standard WP Editor and shortcode, or through page builders like Avada Page Builder, Divi Page Builder, WPBakery Page Builder or Elementor. All tables (except simple table) will become sortable and will have pagination by default.

Additionally, each table (except simple table) can have a search bar and can have the following functions: “Copy to Clipboard”, “Export to CSV”, “Export to PDF”, “Export to XLS”. All these functionalities are configurable and it is your decision whether to toggle these on or off.

Following column data types are supported in data tables (Data tables created from Excel, CSV, JSON, XML or Serialized PHP array). Most column types, except the images, have their own sorting rules:

String – Text and video documentation
Integer – Text and video documentation
Float – Text and video documentation
Date – Text and video documentation
DateTime – Text and video documentation
Time – Text and video documentation
Image – Text and video documentation
URL link – Text and video documentation
E-mail link – Text and video documentation

Please note some limitations compared to the Premium version of the wpDataTables plugin:

MySQL-query based tables support is not included.
Creating tables from the Google Spreadsheet files is not included.
Create a table manually is not included.
Server-side processing is not included.
Responsive mode for the tables is not included.
Table filters are not included.
Front-end table editing is not included.
Excel-like editing is not included.
Advanced HighCharts and ApexCharts are not included.
Table Constructor Wizard (step-by-step table generator) is not included.
Customize options for each table are not included.
Access to our premium support system is not included.

You can get all of these features by purchasing the Premium version on the plugin’s site.

Please note that wpDataTables requires PHP 5.6 or newer!

wpDataTables vs wpDataTables Premium

If you still can’t decide which wpDataTables version to choose, you should get familiar with the basic features of both of them, and then take it from there. It all boils down to the type of tables in WordPress that you want to create.

wpDataTables

If you don’t require the most advanced features because you only create a table in WordPress every now and then, wpDataTables is perfect for you.

wpDataTables Premium

While the basic version is great for people who create small and simple tables, wpDataTables Premium is the best WordPress table plugin and it comes with a huge set of amazing features.
However, the thing that really sets it apart is the possibility to manage any amount of data and create huge responsive tables in WordPress.

Do I Need wpDataTables?

Well, the short answer is – yes. If you want to create fully functional and great looking WordPress tables, you need wpDataTables. The number of the users currently taking advantage of this plugin is 30,000 and counting.
The major features of wpDataTables include but are not limited to:

Building WordPress tables quickly and easily – no complicated configuration; just simple clicking;
No coding knowledge required;
Fully customizable WordPress tables and charts – from choosing the color palette to inserting elements such as your company logo, wpDataTables allows you to customize your tables and charts in any way you see fit;
A WordPress table plugin that works like a spreadsheet app – with all the advanced features and tools, wpDataTables truly stands out from the competition;
1 year of updates and support

Additional useful features include:

NEW! Customize options for each table – Now you can customize each table with different skin, font, background , colors and lot more.
NEW! Create Tables via Google Spreadsheet API – Instant synchronization in wpDataTables after changes in Google sheets. Create tables from Private Google Spreadsheets.
Multiple databases support – wpDataTables is the only WordPress table plugin that can display the data from MySQL, MS SQL or PostgreSQL databases.
Responsive Tables – your WordPress tables will be 100% functional and they will look great on all screen and devices
Huge Amount of Data – wpDataTables Premium can create huge tables in a matter of minutes. All the operations will be handled by the MySQL server.
Editable Tables – you or any other WordPress user with access will be able to edit and/or adjust the published tables at any point
Advanced Filters and Search– you will be able to create individual filters that will help you narrow the search results in the table quickly and easily. You can also configure a cascade filter with the Powerful Filters addon.
Highlighting – highlighting the rows, columns, cells of your WordPress tables etc. has never been easier with this plugin’s conditional formatting feature
Charts – you can easily turn every WordPress table into a beautiful chart. Charts are rendered by 4 powerful engines (Google, Highcharts, Chart.js and NEW ApexCharts) and can change in real-time.
Calculating Tools – calculating a sum, average, minimum and maximum of all the values for a given column is easier than ever with the wpDataTables advanced calculating tools
Placeholders – make dynamic SQL Queries and use it through the shortcodes and as predefined values in filters and editing.

Extend wpDataTables functionality with add-ons

wpDataTable Lite and Premium users have the option to extend wpDataTables functionality with FREE add-ons such as:
1. Forminator Forms Integration – that allows you to create wpDataTables from Forminator Forms submissions.

wpDataTable Premium users have the option to extend wpDataTables functionality with premium add-ons such as:
1. Master-detail tables** – which allows you and your site visitors to see details for each row with a simple click (view on popup or custom page/post)
1. Powerful Filters** – to filter table data in the WordPress Tables frontend with Cascade filters; it also allows you to hide the table before the filter is applied; show search button;
1. Report Builder** – Generate Word or Excel reports from tables in your WP in 1 click
1. Gravity Forms integration** – allows you to create editable wpDataTables from Gravity Forms entries data.
1. Formidable Forms Integration** – that allows you to create wpDataTables from Formidable Forms entries data.

**Those add-ons are not included in the premium plugin. They have to be purchased separately.

What do people say about wpDataTables?

★★★★★

Great plugin, great features, great support. Highly customizable and performing. – mirkolofio

★★★★★

This plugin is very useful and has save me countless hours. The support is top-notch as well. Literally one of the most impressive plugins that I use. – heatherlsi

★★★★★

This is the best plugin for displaying tables and charts! And the support is the best one I had on WordPress. Responses within hours and problem fix the same day ! – ldeschenes

★★★★★

I don’t do many reviews, but my experience with wpDataTables has been awesome; from using the plugin to interacting with customer service and their support team. I was pretty amazed that even through the holiday season the support team replied quickly to my request. – tekv

★★★★★

I am impressed. I thought this would be a basic plugin, but it is a very powerful and versatile plugin that offers many tools and settings. And if you need a hand using the plugin, their support is ready to help. Very professional. – mycamgirl

This plugin provides 2 blocks.

wpDataTables - Tables & Table Charts
wpDataTables - Tables & Table Charts

Installation of the plugin is really simple.

Install using one of these options:
- Install directly from WordPress Admin panel: go to Plugins -> Add New -> Search for “wpDataTables”, and click the Install button.
- Download the ZIP manually from WordPress’ plugins repository, and upload it through WordPress Admin panel: go to Plugins -> Add New -> Upload Plugin, browse to the downloaded Zip and upload it.
- Download the ZIP, extract it and manually upload the extracted folder through FTP to the /wp-content/plugins/ directory of your WordPress installation.
Activate the plugin through the ‘Plugins’ menu in WordPress.
That’s it!

Usually this happens when PHP version is older than 5.4 is installed. Please first check this, and upgrade to PHP 5.4 or more, if that’s the issue.

Go to display tab of the table settings block and disable the “Info block” setting.

You can configure how the links will be opened by toggling the “URL target attribute” switch
In the Data tab of the Column Settings popup. It is up to you to define for each URL column if you prefer the link to open in a new or in the same tab.

Go to display tab of the table settings block and disable the “Rows per page” setting.

How to add symbols or text before/after cell values without affecting sorting (currency, percents, etc.)

For every table column in the column settings modal you can find text fields “Cell content prefix” and “Cell content suffix” in Display tab.
Values from those text fields will be appeared before or/and after every cell content in a column.
This feature uses CSS for displaying the entered text, therefore sorting of the columns will not be affected.

How to change the format of dates?

Date format can be changed in wpDataTables Settings page using the “Date format” drop-down menu.

How to change a thousand and decimal separators for number columns?

This can be changed from the “Number format” drop-down menu in the wpDataTables Settings page.

The plugin saved me so much development time! The project was a remote mySQL database real time table with some data and styling logic. The design environment is very logical and I think that it will be very easy to maintain the plugin even for a non-programmer. I did not come across any bugs in the plugin - the tech support is excellent (Thank you Miloš very much)! They go out of their way to help you with your project. The documentation is well put together. I found answers pretty much every time I searched. I would very much recommend this plugin!

Plugin offers many options to include tables on Wordpress website and to customize them. When facing a minor problem with our theme, we registered a ticket and customer service was fantastic. Aleksandar Vukovic, the specialist asssigned to our case, was kind, fast and efficient. Highly reccomend their plugin and customer service.

Já usei outras alternativas, mas quando encontrei a “wpDataTables” fiz questão de eliminar todos os outros plugins deixando wpDataTables como principal. Super recomendado!

The most powerful and functional table plugin for WordPress! This plugin also has the most charts. Highly recommend!

Other platforms maybe be simpler for basic data but this plugin is nice for anything more complex

I’ve used this plugin for years. Excellent plugin and support staff.

Read all 253 reviews

“wpDataTables – Tables & Table Charts” is open source software. The following people have contributed to this plugin.

Contributors

wpDataTables

2.1.31

Improvement: Remove unnecessary files from Divi integration.
Other small bug fixes and stability improvements.

2.1.29

BugFix: Fixed issue with inserting spaces for column prefix and suffix.
Compatibility with WordPress 5.9.3 approved.
Other small bug fixes and stability improvements.

2.1.28

Improvement: Improved custom JS and CSS layout
BugFix: Fixed issue with Jet plugins in Elementor widgets.
BugFix: Fixed issue with Gutenberg blocks when Avada’s post/page types are disabled.
BugFix: Fixed issue with merge cells from context menu.
BugFix: Fixed issue with XSS vulnerability founded by mOze.
Other small bug fixes and stability improvements.

2.1.27

Feature: Chart.js enabled with 9 new chart types as second chart rendering engine. Beside Google Charts, we have added Chart.js that renders simple and flexible charts with a lot of customization options.
Improvement: Improved integration with Divi Builder.
Improvement: Added new filters for each chart engine render data: wpdatatables_filter_google_charts_render_data and wpdatatables_filter_chartjs_render_data.
Compatibility with WordPress 5.9.2 approved.
Other small bug fixes and stability improvements.

2.1.26

Feature: Added integration with Avada Website builder. Read more on this link Avada Page builder integration for wpDataTables.
Feature: Added integration with DIVI Website builder. Read more on this link DIVI Website builder integration for wpDataTables.
Improvement: Added export file name parameter in module for WPBakery page builder.
Improvement: Replaced deprecated methods for Elementor integration.
Bugfix: Fixed enqueue minify version wpdatatables-bootstrap.min.css
Other small bug fixes and stability improvements.

2.1.25

Bugfix: Removed extra quotes from img element in simple table
Compatibility with WordPress 5.9 approved.
Other small bug fixes and stability improvements.

2.1.24

Compatibility with WordPress 5.8.3 approved.
Other small bug fixes and stability improvements.

2.1.23

Improvement: Reduce plugin size by removing unnecessary files
Bugfix: Fixed CSS conflicts with Gravity forms.
Other small bug fixes and stability improvements.

2.1.22

Improvement: Added pagination above the table on browse page for tables and charts.
Improvement: Added new hook to filter URL of PHP array tables: wpdatatables_filter_url_php_array.
Improvement: Add new pre-formatted hooks for all column types in datatables:
wpdatatables_filter_date_cell_before_formatting, wpdatatables_filter_time_cell_before_formatting,
wpdatatables_filter_datetime_cell_before_formatting, wpdatatables_filter_link_cell_before_formatting,
wpdatatables_filter_email_cell_before_formatting, wpdatatables_filter_string_cell_before_formatting,
wpdatatables_filter_int_cell_before_formatting, wpdatatables_filter_float_cell_before_formatting
and wpdatatables_filter_image_cell_before_formatting.
Bugfix: Fixed notice for deprecated hook in Gutenberg.
Bugfix: Fixed issue with browsing tables and charts with search
Compatibility with WordPress 5.8.2 approved.
Other small bug fixes and stability improvements

2.1.21

Feature: Added new options for link columns in datatables (noreferrer and sponsored attributes)
Feature: Added new options for link editor in simple table (noreferrer and sponsored attributes)
Other small bug fixes and stability improvements

2.1.20

Feature: Added clear button in color-picker in simple table.
Bugfix: Fixed resetting CSS rule for background and text color in simple table editor.
Other small bug fixes and stability improvements

2.1.19

Feature: Added new option for the simple table: “Remove borders”.
Feature: Added new option for the simple table: “Border collapse” .
Feature: Added new option for the simple table: “Border spacing”.
Improvement: Improved checking for existing PHP extension – zlib on the server.
Compatibility with WordPress 5.8.1 approved.
Other small bug fixes and stability improvements

2.1.18

Feature: Added new option “Page Orientation” for PDF export reports.
Feature: Added new option “Paper Size” for PDF export reports.
Other small bug fixes and stability improvements.

2.1.17

Bugfix: Removed unnecessary CSS.
Other small bug fixes and stability improvements.

2.1.16

Feature: Added Font and Font size options in simple table.
Feature: Added new option for showing HTML code in exported files like Print, Copy, CSV and Excel.
Updated moment.js library.
Compatibility with WordPress 5.8 approved.
Other small bug fixes and stability improvements.

2.1.15

Bugfix: Removed unnecessary CSS.
Other small bug fixes and stability improvements.

2.1.14

Added new hooks wpdatatables_filter_int_cell_data_in_charts and wpdatatables_filter_float_cell_data_in_charts.
Bugfix: Fixed layout of copy to clipboard element.
Bugfix: Fixed CSS issue in simple tables on mobile devices.
Bugfix: Fixed issue with changing colors in charts.
Bugfix: Fixed conflict on back-end with Gravity forms tooltips
Other small bug fixes and stability improvements.

2.1.13

New FREE addon: “Forminator Forms integration for wpDataTables” available. Tool that adds “Forminator Form” as a new table type and allows you to create wpDataTables from Forminator Forms submissions. More on this link.
BugFix: Fixed issue with strings in loops (conflict with other plugins).
BugFix: Fixed issue with color-picker visibility in column color option on small screens.
BugFix: Fixed issue with showing quotes in charts.
BugFix: Fixed issue with Notice on Dashboard page.
BugFix: Fixed issue with JS notices about sourceMappingURL’s.
Compatibility with WordPress 5.7.2 approved.
Other small bug fixes and stability improvements.

2.1.12

BugFix: Fixed issue with spaces in column headers
BugFix: Fixed issue with not saving tooltip options in charts
BugFix: Fixed error message on the welcome page.
Compatibility with WordPress 5.7.1 approved.
Other small bug fixes and stability improvements.

2.1.11

BugFix: Fixed issue with not showing simple editor on Safari browser
BugFix: Fixed issue with welcome page on bulk plugin activation
BugFix: Fixed some PHP Notice messages
BugFix: Fixed issue with table borders in simple table
Other small bug fixes and stability improvements.

2.1.10

Feature: Add new option for creating 3D pie chart
Feature: Search for tables and charts using ID on browse pages
Added translate functions on several strings.
Added German translation
Bugfix: Fixed issue with Fatal errors if allow_url_fopen is turned off on server.
Bugfix: Fixed issue with loading simple table preview after clicking on back button in browser from some pages.
Bugfix: Fixed issue with inserting “px” in column width option.
Compatibility with WordPress 5.7 approved.
Other small bug fixes and stability improvements.

2.1.9

Improvement: Added auto-save functionality after insert media in Simple tables
Improvement: Added translate functions on some strings
Improvement: Added new hooks for enqueuing scripts in admin area and filters for elementor widgets
BugFix: Fixed issue with font in material skin and background in graphite skin.
BugFix: Fixed issue with class name in Global font color settings.
Compatibility with WordPress 5.6.2 approved.
Other small bug fixes and stability improvements.

2.1.8

Feature: Added new date formats
BugFix: Fixed issue with warnings and notices with simple table and other page builders.
BugFix: Fixed issue with showing charts with WP rocket caching.
BugFix: Fixed issue with counter variable in charts.
Compatibility with WordPress 5.6.1 approved.
Other small bug fixes and stability improvements.

2.1.7

Feature: New option to set column data to be available/disabled in global Search results
Feature: New option to set NOFOLLOW relation for links in simple and data tables
BugFix: Fixed issue with saving page in Divi builder with simple table shortcode.
BugFix: Fixed issue with not showing tabs in backend after switch.
BugFix: Fixed issue with tooltip when is loaded jQuery UI.
BugFix: Fixed issue with disappearing Display length selectbox.
Other small bug fixes and stability improvements.

2.1.6

BugFix: Fixed issue with Fatal errors on Dashboard page if PHP extensions are not installed.
Compatibility with WordPress 5.6 approved.
Compatibility with PHP 8 approved.
Other small bug fixes and stability improvements.

2.1.5

Improvement: Replaced PHPExcel library with PhpSpreadsheet library.
BugFix: Fixed issue with deprecated errors.
Notice: From this version required PHP version is 5.6 or newer!
Other small bug fixes and stability improvements.

2.1.4

A major update with a couple of new features, bug fixes and stability improvements:
* Feature: Elementor integration – Added Elementor Blocks for tables and charts.
* Feature: New option to hide pagination for each table.
* Feature: New option to set pagination position for each table.(Right, center and left)
* Feature: New option to set pagination layout for each table.(Six different layouts)
* Feature: New option to set tables sorting order on browse pages.
* BugFix: Fixed issue for reset options Remove borders.
* BugFix: Fixed issue with showing tables in Internet Explorer browser.
* BugFix: Remove wpdt-c class from admin area on other admin pages
* BugFix: Correct folder name for Slovenian language.
* BugFix: Fixed issue with removing message modals in admin area
* BugFix: Fixed issue for simple tables with random sorting.
* Other small bug fixes and stability improvements.

2.1.3

Feature: New table type – Create a simple table with any data, merged cells, styling, star rating and a lot more.
Feature: Added Slovenian translation
Improvement: Update French translation
Improvement: Added new color picker
Other small bug fixes and stability improvements.

2.1.2

Fixed issue with the slow backend
Fixed issue with loader after saving global plugin settings
Bug fixes and stability improvements.

2.1.1

Bug fixes and stability improvements.
Compatibility with WordPress 5.5 approved.

2.1

Design: New fresh admin UI.
New page: New Dashboard page with lots of useful information and guides.
New page: New detailed System Info page which simplifies resolving external conflicts.
Feature: New Popup First-launch Guide with feature explanations for new users.
Feature: New options like Feature suggestion, Subscription and lot more.
Feature: Now it is possible to create all Google charts.
Feature: Chart Tooltips are enabled.
Feature: Global Table Customization are available (Color And Font Settings)
Notice: For next update of wpDataTables Lite it will be required 5.6 version of PHP, so the users who have still 5.4 have time to upgrade.
Bug fixes and stability improvements.
Compatibility with WordPress 5.4.2 approved.

2.0.21

Bug fix: Issue with Gutenberg hooks
Compatibility with WordPress 5.4.1 approved.

2.0.19

Bug fix: Issue with padding in container for Aqua skin in backend
Bug fix: Issue with padding for ellipsis button in pagination
Compatibility with WordPress 5.4 approved.

2.0.18

Added option for title on Print button
Bug fix: Issue for enabling Apply button on input/paste URL input
Bug fixes and stability improvements.

2.0.17

Updated Russian translation
Bug fixes and stability improvements.

2.0.16

A minor update with a couple of small bugfixes:
Bugfix: Fixed conflict with WooCommerce product page and Gutenberg
Resolved minor security issue – added nonce on Settings page
Compatibility with WordPress 5.3.2 approved.

2.0.15

A minor update with a couple of small bugfixes:
BugFix: Plugin is now compatible with jQuery 3.x.
BugFix: Fix PHP notices
Compatibility with WordPress 5.3 approved.

2.0.14

Feature: Added new date formats
Updated French translation
Updated core of Datatables library
Bug fixes and stability improvements.
Compatibility with WordPress 5.2.3 approved.

2.0.13

Feature: Removed limitation for number of rows in tables
Feature: Added functionality for creating Google charts(Line, Column and Pie)
Feature: Added options for customizing Google charts(Line, Column and Pie)
Bug fixes and stability improvements.

2.0.12

Bug fixes and stability improvements.

2.0.11

Bug fixes and stability improvements.
Compatibility with WordPress 5.2.2 approved.

2.0.10

Bug fixes and stability improvements.

2.0.9

Feature: Added Gutenberg block – the plugin is now Gutenberg optimized.
Feature: Added option to choose whether you want to keep the tables after deleting the plugin from the Plugins page (by default the tables will be saved in database after deleting the plugin).
Bug fixes and stability improvements.
Compatibility with WordPress 5.2.1 approved.

2.0.8

Bug fixes and stability improvements.
Compatibility with WordPress 5.1.1 approved.

2.0.7

New skins and new UI elements – a new Dark and Purple-style skins for tables front-end, new UI elements;
Bug fixes and stability improvements.
Compatibility with WordPress 5.1 approved.

2.0.6

New skin and new UI elements – a new Aqua-style skin for tables front-end, new UI elements;
Bug fixes and stability improvements.
Compatibility with WordPress 5.0 approved.

2.0.5

Added more Date formats
Bug fixes and stability improvements.

2.0.4

Added French language for translation
Bug fixes and stability improvements.
Compatibility with WordPress 4.9.8 approved.

2.0.3

An option to choose CSV delimiter in the Settings page.
Bug fixes and stability improvements.
Compatibility with WordPress 4.9.7 approved.

2.0.2

The plugin’s design was re-worked from scratch to a more intuitive, smooth and user friendly interface following Material Design guidelines;
New skin and new UI elements – a new Material-style skin for tables front-end, new UI elements;
Feature: Checkbox for including Bootstrap on the front-end added on the Settings page;
Feature: New settings for URL link columns – now it is possible e.g. to make them display as buttons, configure if the links should open in a new tab, or change the default text;
Fix: removed “All” when table displays all of the entries, and if you have less entries than selected displayed length;
Under-the-hood improvements
Security and stability improvements;
A number of other minor bugfixes;
Compatibility with WordPress 4.9.1 approved.

1.2.3