Serving WordPress Security Globally

Unauthenticated Stored XSS in wpDataTables (≤ 6.5.0.4) — What WordPress Sites Need to Know and How WP-Firewall Protects You

Unauthenticated Stored XSS in wpDataTables (≤ 6.5.0.4) — What WordPress Sites Need to Know and How WP-Firewall Protects You

wpDataTables CVE-2026-5721 Vulnerability

Plugin Name wpDataTables
Type of Vulnerability Cross-Site Scripting (XSS)
CVE Number CVE-2026-5721
Urgency Low
CVE Publish Date 2026-04-20
Source URL CVE-2026-5721

Unauthenticated Stored XSS in wpDataTables (≤ 6.5.0.4) — What WordPress Sites Need to Know and How WP-Firewall Protects You

Summary

  • Vulnerability: Unauthenticated stored Cross‑Site Scripting (XSS).
  • Affected versions: wpDataTables plugin ≤ 6.5.0.4.
  • Patched in: 6.5.0.5.
  • CVE: CVE-2026-5721.
  • CVSS (reported): 4.7 (medium/low depending on context).
  • Key risk: Attacker can store malicious HTML/JS that executes when an administrator or privileged user views certain plugin pages; exploitation often requires the victim (admin/editor) to view or interact with the malicious content.

As the team behind WP-Firewall, we want to make this technical issue easy to understand and give you pragmatic, prioritized actions you can take immediately — whether you’re a site owner, developer, or hosting provider. This post covers what the vulnerability is, why it matters, realistic attack scenarios, detection and remediation steps, and concrete WAF-based mitigations that buy you time when you cannot apply the vendor patch right away.

Why this matters

Stored XSS is one of the more dangerous types of cross-site scripting. Unlike reflected XSS, where an attacker must trick a user into clicking a specially crafted URL, stored XSS persists in the application (e.g., in database fields, table content, comments, or plugin data). When a legitimate user — often a site administrator or editor with higher privileges — opens an interface that renders the stored content, the browser interprets the malicious payload and executes it in the context of your site.

In the case of the wpDataTables issue (CVE-2026-5721), an unauthenticated attacker could inject content that is later rendered inside the plugin user interface. Because the payload is stored and then rendered in pages that administrators view, the effective impact can escalate: session hijacking, privilege escalation via CSRF-style actions performed in the admin’s context, or persistent backdoors placed into site pages.

While public scoring places this issue at a modest CVSS value, real-world impact depends on several factors:

  • Whether administrators routinely preview or open plugin-managed tables from untrusted sources.
  • Whether the plugin is used to display or import user-submitted data.
  • Whether the site has additional hardening (WAF, CSP, HTTP-only cookies, CSRF protections) that makes exploitation harder.

Because the vulnerability allows unauthenticated injection of payloads that execute when a privileged user accesses them, it’s an attractive vector for mass scanning and automated campaigns.

How the attack chain typically looks (high-level, non-exploitative)

We will not publish payloads or exploitation steps. Instead, here’s a conceptual outline of how an attacker might attempt to exploit this type of stored XSS:

  1. Attacker identifies a vulnerable input field in the plugin (for example: table titles, custom fields, imported CSV columns, or user-submitted table data).
  2. Attacker submits content containing HTML/JS constructs that the plugin later stores without sufficient sanitization/escaping.
  3. The malicious content is saved in the site database.
  4. When an administrator (or other privileged role) loads the affected plugin page, the stored content is output to the page and the browser executes the malicious scripts in the context of the admin’s session.
  5. The executed script performs actions such as stealing session tokens / cookies, performing privileged actions via authenticated requests, or injecting additional admin-facing content that persists.

Understanding this chain is important: the initial submission can come from an unauthenticated user, but exploitation generally requires a privileged user to view the stored content.

Realistic risk scenarios

  • Admin session theft: The malicious script attempts to exfiltrate authentication tokens or session cookies to a remote server controlled by the attacker.
  • Administrative actions: Scripts run in the administrator’s browser could attempt to perform actions via the WordPress admin REST API or admin-post endpoints (for example, creating a new admin user, modifying plugin settings, or exporting data).
  • Reconnaissance & persistence: Once a foothold is achieved, attackers may install persistent backdoors or plant content that helps future automated attacks.
  • Mass exploitation: Automated scanners will look for publicly reachable endpoints and try to submit payloads. Sites that are part of a large install base for popular plugins are at higher risk of being swept in mass exploitation campaigns.

Detection — signs to look for

Detecting stored XSS can be tricky, but there are practical indicators:

  • Unexpected or unexplained HTML or script-looking content inside wpDataTables tables, column headers, or configuration fields.
  • Admin complaints about redirects, unexpected popups, or pages behaving oddly when visiting plugin pages.
  • Outbound connections to unusual domains originating from admin browsers (could be seen in browser dev tools during investigation or in network logs).
  • New or unexpected administrator users, changes in plugin settings, or unfamiliar files appearing in wp-content/uploads or plugin directories (post-exploitation indicators).
  • WAF logs showing repeated POSTs with suspicious payloads to endpoints associated with the plugin.

Set up logging for:

  • All POST/PUT requests that interact with plugin endpoints.
  • Admin user actions via the audit logs.
  • Outbound DNS/HTTP requests from the server (unexpected data exfiltration attempts sometimes show up as DNS exfiltration).

If you operate multiple sites, pay particular attention to abnormal patterns across sites — automated scanners typically hit many installations in short time windows.

Immediate action — prioritized checklist

  1. Update the plugin to 6.5.0.5 or later immediately.
    • This is the single most effective step. The vendor released a patch that fixes the issue; apply it on all affected sites.
  2. If you cannot update immediately, take compensating controls:
    • Disable the plugin temporarily, if feasible.
    • Limit access to plugin admin pages (restrict by IP or require VPN).
    • Put the site in maintenance mode for admin-level users until patching completes.
  3. Use your WAF to virtual-patch: create rules that block or sanitize likely exploit payloads (examples and guidance below).
  4. Audit your site for indicators of compromise (IOC):
    • Review recent admin logins, user changes, and posts for suspicious content.
    • Scan uploads and plugin directories for unauthorized files.
    • Perform a malware scan and integrity check of core/plugin/theme files.
  5. Rotate credentials of administrative accounts and any API keys that could be affected.
  6. Review and strengthen security headers and CSP to reduce the attack surface (see hardening section).

Apply these measures in that order: updating is highest priority, followed by virtual patching and detection.

WAF / virtual patching guidance from WP-Firewall

If you run a Web Application Firewall (WAF) — whether as a plugin, reverse proxy, or host-managed service — you can mitigate exploitation before the vendor patch is applied. Virtual patching doesn’t replace a vendor patch but buys time.

General virtual-patching strategy:

  • Deny requests that attempt to inject HTML/JS into fields that should not accept markup.
  • Sanitize incoming POST bodies for suspicious tokens.
  • Apply strict rules only to affected endpoints to avoid false positives.

Recommended rule patterns to block (examples; tune and test before deploying):

  • Block requests with raw script tags or common obfuscation:
    • Look for patterns like <script, </script, %3Cscript, <script, or javascript: in POST parameters targeted at plugin endpoints.
  • Block event handlers and inline JS attributes:
    • Attributes such as onerror=, onload=, onclick= appearing in fields that should be plain text.
  • Block suspicious URIs or data URIs:
    • data:text/html, data:text/javascript, or overly long data: payloads posted to the plugin.
  • Block encoded payloads patterns:
    • Repeated sequences of &#x, &#</code>, <code>%3C</code>, or <code>%3E</code> combined with HTML tags in parameters.</li> </ul> </li> <li>Limit field length and permitted character sets: <ul> <li>If a field is intended to be a table name or label, limit to alphanumerics, spaces, dashes and underscores. Reject embedded <code>&lt;</code> or <code>&gt;</code> characters.</li> </ul> </li> <li>Geo/IP rules: <ul> <li>If you see exploitation traffic originating from a small set of high-risk IP ranges, temporarily block or challenge them (use rate limiting and challenge pages).</li> </ul> </li> </ul> <p><strong>Example (pseudo) WAF rule logic — do not paste as an exploit:</strong></p> <ul> <li>If POST to <code>/wp-admin/admin.php?action=wpdatatables*</code> and request-body contains <code>&lt;script</code> OR <code>onerror=</code> OR <code>javascript:</code> then block with a 403 and log details.</li> <li>If POST to any wpDataTables import endpoint and a CSV column value contains <code>&lt;</code> or <code>&gt;</code> characters above a threshold, block or sanitize.</li> </ul> <p><strong>Important:</strong> Test rules in monitor/log-only mode first to assess false positives. Fine-tune rules to target only the plugin endpoints or admin AJAX hooks to avoid impacting other functionality.</p> <h3>Content Security Policy (CSP)</h3> <ul> <li>Deploy a restrictive CSP for admin pages (wp-admin), for example: <ul> <li><code>default-src 'self'; script-src 'self' 'nonce-xxxx' 'strict-dynamic'; object-src 'none';</code></li> </ul> </li> <li>CSP is an effective secondary barrier; however, a misconfigured CSP or pages that allow unsafe inline scripts may blunt its effect. Use nonces or hashes for legitimate admin scripts.</li> </ul> <h3>HTTP headers to improve defenses</h3> <ul> <li>Set cookies with HttpOnly and SameSite=strict for admin sessions.</li> <li><code>X-Content-Type-Options: nosniff</code></li> <li><code>X-Frame-Options: SAMEORIGIN</code></li> <li><code>Referrer-Policy: no-referrer-when-downgrade</code> (or stricter based on site needs)</li> <li><code>Strict-Transport-Security: max-age=31536000; includeSubDomains; preload</code></li> </ul> <p><strong>Note on false positives:</strong></p> <ul> <li>Be mindful of legitimate workflows: wpDataTables can accept certain HTML in controlled contexts (e.g., formatted table cells). Apply rules conservatively, focus on plugin admin endpoints and unauthenticated POSTs.</li> </ul> <hr> <h2>Incident response checklist (if you suspect compromise)</h2> <p>If you find evidence that an exploit has already been used against your site, follow an incident response procedure:</p> <ol> <li><strong>Snapshot and isolate:</strong> <ul> <li>Take a full backup and snapshot server state for forensics.</li> <li>If possible, take the site offline and display a maintenance page while investigating.</li> </ul> </li> <li><strong>Identify scope:</strong> <ul> <li>Identify what data was modified, which admin accounts logged in, and which files were changed.</li> <li>Check for the creation of unauthorized users and malicious scheduled tasks (cron entries).</li> </ul> </li> <li><strong>Remove persistent backdoors:</strong> <ul> <li>Look for PHP files in uploads, unexpected mu-plugins, or modified core/plugin files.</li> <li>Reinstall WordPress core and all plugins from trusted sources (do not overwrite content before ensuring no backdoors persist in uploads or database).</li> </ul> </li> <li><strong>Rotate secrets:</strong> <ul> <li>Reset administrator passwords and any API keys; revoke tokens that may have been exposed.</li> </ul> </li> <li><strong>Restore from clean backup:</strong> <ul> <li>If you have a known-good backup from before the compromise, consider restoring from it — but ensure the vector is patched before returning to production.</li> </ul> </li> <li><strong>Post-recovery hardening:</strong> <ul> <li>Apply patches, enable WAF protections, enable 2FA for admin accounts, and deploy monitoring.</li> </ul> </li> </ol> <p>If you host client sites or manage multiple installs, coordinate communications with stakeholders. Keep a record of actions taken and evidence for possible follow-up by legal or forensic teams.</p> <hr> <h2>Hardening recommendations to reduce impact of future stored XSS</h2> <p>Beyond patching and WAFing, apply these longer-term recommendations:</p> <ul> <li><strong>Principle of least privilege:</strong> <ul> <li>Minimize the number of users with administrator roles; use editor/contributor roles where appropriate.</li> </ul> </li> <li><strong>Two‑Factor Authentication (2FA):</strong> <ul> <li>Require 2FA for all high‑privilege accounts.</li> </ul> </li> <li><strong>Admin interface access controls:</strong> <ul> <li>Restrict wp-admin access by IP range or use a VPN for administrative work.</li> </ul> </li> <li><strong>Regular updates:</strong> <ul> <li>Keep WordPress core, plugins, and themes updated. Use an update process that includes testing on staging.</li> </ul> </li> <li><strong>Audit logging:</strong> <ul> <li>Maintain detailed logs of admin actions (post creation, user changes, plugin configuration changes).</li> </ul> </li> <li><strong>Plugin inventory and minimization:</strong> <ul> <li>Remove unused plugins. Each plugin increases attack surface.</li> </ul> </li> <li><strong>Content sanitization:</strong> <ul> <li>Ensure plugins that accept user content use proper sanitization/escaping functions and do not allow unrestricted HTML in admin contexts.</li> </ul> </li> <li><strong>Periodic security reviews:</strong> <ul> <li>Run vulnerability scans for known CVEs and perform code audits on critical plugins or custom code.</li> </ul> </li> </ul> <hr> <h2>How WP-Firewall helps</h2> <p>As a WordPress-focused WAF and security service, our approach is layered:</p> <ul> <li>Rapid threat intelligence ingestion to identify trending exploit attempts.</li> <li>Virtual patching rules deployed to block known exploit patterns at the edge.</li> <li>Context-aware rules that focus on the plugin endpoints and admin paths to minimize false positives.</li> <li>Continuous monitoring and alerting on suspicious admin activity and exploit attempts.</li> </ul> <p>If you run WP-Firewall on your site, we will:</p> <ul> <li>Flag attempts targeting known wpDataTables endpoints and block suspicious payloads.</li> <li>Provide clear log entries and diagnostic details so you can assess risk quickly.</li> <li>Suggest targeted mitigations and help with cleanup guidance if compromise indicators are seen.</li> </ul> <p>We emphasize practical, low-friction protections: virtual patches that don’t break functionality, plus guidance for safe plugin updates and incident investigation.</p> <hr> <h2>Practical admin checklist you can run now</h2> <ol> <li>Immediately update wpDataTables to version 6.5.0.5 or later on all sites.</li> <li>If you manage many sites, roll out the update via your management tooling or schedule a deployment window and verify functionality on staging first.</li> <li>Put additional monitoring on wp-admin pages and plugin-related endpoints: <ul> <li>Log 4xx/5xx events and unusual POST bodies.</li> </ul> </li> <li>Scan site for suspicious HTML/JS in plugin-managed tables and fields (search for <code>&lt;script</code>, <code>javascript:</code>, <code>onerror=</code>, <code>onload=</code> in database fields tied to the plugin).</li> <li>Review recent admin sessions and logins; rotate passwords for compromised accounts and enforce 2FA.</li> <li>Implement WAF rules that block simple script injections against plugin endpoints and run these as “log-only” initially if you’re concerned about false positives.</li> </ol> <hr> <h2>Frequently asked questions (short)</h2> <p><strong>Q:</strong> Is every site using wpDataTables at risk?<br /> <strong>A:</strong> Only sites that run vulnerable versions (≤ 6.5.0.4) are affected. Risk is higher if plugin areas render user-submitted or imported data and if administrators view those pages.</p> <p><strong>Q:</strong> Does an attacker need to be logged in?<br /> <strong>A:</strong> No — the vulnerability allows unauthenticated storage of payloads. However, for the malicious JavaScript to have administrative privileges it needs to run in the browser of a logged-in admin who views the affected page.</p> <p><strong>Q:</strong> If I update, do I still need a WAF?<br /> <strong>A:</strong> Yes. Patching is primary, but WAF and additional hardening protect you from zero-days, delayed patches, and automated scanning campaigns.</p> <p><strong>Q:</strong> Are there reliable indicators of compromise?<br /> <strong>A:</strong> Unexpected admin behavior, new admin users, unexplained file changes, outbound connections to unknown domains, and presence of HTML/script tags in data fields are all red flags.</p> <hr> <h2>An invitation to test WP-Firewall protections (free plan)</h2> <p>Protecting your site against plugin vulnerabilities and persistent abuse is easier with layered defenses in place. We offer a free plan that provides essential protection and is an excellent starting point for any WordPress site:</p> <h3>Secure Your Site with WP-Firewall — Free Tier Details</h3> <ul> <li>Essential protection: Managed firewall rules tailored for WordPress, unlimited bandwidth, Web Application Firewall (WAF), a malware scanner and mitigation coverage for OWASP Top 10 risks.</li> <li>Why the free plan helps: It provides edge-level blocking for common automated attacks and a safety net while you perform updates or conduct deeper investigations. If you prefer more proactive remediation, our paid tiers add automated malware removal, IP blacklisting/whitelisting, vulnerability virtual patching, monthly security reports and premium support options.</li> </ul> <p><a href="https://my.wp-firewall.com/buy/wp-firewall-free-plan/" target="_blank" rel="noopener noreferrer">Sign up for the free plan and get immediate basic protections</a></p> <hr> <h2>Final thoughts from WP-Firewall</h2> <p>CVE-2026-5721 highlights a perennial truth in WordPress security: popular functionality that accepts data is a high-value target. The best defense is a layered one — vendor patches, tight privilege control, WAF virtual patches, monitoring, and stronger admin practices. Patching the plugin to version 6.5.0.5 or later is the fastest way to eliminate the known vulnerability. If immediate patching is not feasible, deploy the compensating controls outlined above.</p> <p>If you need help triaging an incident, rolling out a safe update across many sites, or applying virtual patches that minimize downtime and false positives, our security team is available to assist with tailored guidance and managed remediation options.</p> <p>Stay safe, and treat plugin updates and WAF rules as essential parts of your WordPress maintenance routine — not optional extras.</p> <p>— WP-Firewall Security Team</p> <h3>References and resources</h3> <ul> <li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5721" target="_blank" rel="noopener noreferrer">CVE listing</a></li> <li>Best practices: OWASP guidance on XSS and defense-in-depth (search OWASP XSS recommendations)</li> <li>WordPress hardening checklist: (use your existing internal checklist or industry standard hardening guides)</li> </ul> </div> <div id="graphcomment"></div> <script type="295c68f3054b91c077c32ba1-text/javascript"> /* - - - CONFIGURATION VARIABLES - - - */ var __semio__params = { graphcommentId: "WP-Firewall", // make sure the id is yours behaviour: { // HIGHLY RECOMMENDED // uid: "...", // uniq identifer for the comments thread on your page (ex: your page id) }, // configure your variables here } /* - - - DON'T EDIT BELOW THIS LINE - - - */ function __semio__onload() { __semio__gc_graphlogin(__semio__params) } (function() { var gc = document.createElement('script'); gc.type = 'text/javascript'; gc.async = true; gc.onload = __semio__onload; gc.defer = true; gc.src = 'https://integration.graphcomment.com/gc_graphlogin.js?' + Date.now(); (document.getElementsByTagName('head')[0] || document.getElementsByTagName('body')[0]).appendChild(gc); })(); </script> <hr class="wp-block-separator has-alpha-channel-opacity"/> <figure class="wp-block-image size-full"><img fetchpriority="high" decoding="async" width="2240" height="1003" src="/assets/uploads/2024/05/wordpress-security-update-banner.jpeg" alt="wordpress security update banner" class="wp-image-1359" srcset"/assets/uploads/2024/05/wordpress-security-update-banner.jpeg 2240w, /assets/uploads/2024/05/wordpress-security-update-banner-300x134.jpeg 300w, /assets/uploads/2024/05/wordpress-security-update-banner-1024x459.jpeg 1024w, /assets/uploads/2024/05/wordpress-security-update-banner-768x344.jpeg 768w, /assets/uploads/2024/05/wordpress-security-update-banner-1536x688.jpeg 1536w, /assets/uploads/2024/05/wordpress-security-update-banner-2048x917.jpeg 2048w, /assets/uploads/2024/05/wordpress-security-update-banner-360x161.jpeg 360w, /assets/uploads/2024/05/wordpress-security-update-banner-1320x591.jpeg 1320w" sizes="(max-width: 2240px) 100vw, 2240px" /></figure> <div class=" mailpoet_form_popup_overlay "></div> <div id="mailpoet_form_1" class=" mailpoet_form mailpoet_form_shortcode mailpoet_form_position_ mailpoet_form_animation_ " > <style type="text/css"> #mailpoet_form_1 .mailpoet_form { } #mailpoet_form_1 form { margin-bottom: 0; } #mailpoet_form_1 p.mailpoet_form_paragraph { margin-bottom: 10px; } #mailpoet_form_1 .mailpoet_column_with_background { padding: 10px; } #mailpoet_form_1 .mailpoet_form_column:not(:first-child) { margin-left: 20px; } #mailpoet_form_1 .mailpoet_paragraph { line-height: 20px; margin-bottom: 20px; } #mailpoet_form_1 .mailpoet_segment_label, #mailpoet_form_1 .mailpoet_text_label, #mailpoet_form_1 .mailpoet_textarea_label, #mailpoet_form_1 .mailpoet_select_label, #mailpoet_form_1 .mailpoet_radio_label, #mailpoet_form_1 .mailpoet_checkbox_label, #mailpoet_form_1 .mailpoet_list_label, #mailpoet_form_1 .mailpoet_date_label { display: block; font-weight: normal; } #mailpoet_form_1 .mailpoet_text, #mailpoet_form_1 .mailpoet_textarea, #mailpoet_form_1 .mailpoet_select, #mailpoet_form_1 .mailpoet_date_month, #mailpoet_form_1 .mailpoet_date_day, #mailpoet_form_1 .mailpoet_date_year, #mailpoet_form_1 .mailpoet_date { display: block; } #mailpoet_form_1 .mailpoet_text, #mailpoet_form_1 .mailpoet_textarea { width: 200px; } #mailpoet_form_1 .mailpoet_checkbox { } #mailpoet_form_1 .mailpoet_submit { } #mailpoet_form_1 .mailpoet_divider { } #mailpoet_form_1 .mailpoet_message { } #mailpoet_form_1 .mailpoet_form_loading { width: 30px; text-align: center; line-height: normal; } #mailpoet_form_1 .mailpoet_form_loading > span { width: 5px; height: 5px; background-color: #5b5b5b; }#mailpoet_form_1{border-radius: 0px;text-align: left;}#mailpoet_form_1 form.mailpoet_form {padding: 10px;}#mailpoet_form_1{width: 100%;}#mailpoet_form_1 .mailpoet_message {margin: 0; padding: 0 20px;} #mailpoet_form_1 .mailpoet_validate_success {color: #00d084} #mailpoet_form_1 input.parsley-success {color: #00d084} #mailpoet_form_1 select.parsley-success {color: #00d084} #mailpoet_form_1 textarea.parsley-success {color: #00d084} #mailpoet_form_1 .mailpoet_validate_error {color: #cf2e2e} #mailpoet_form_1 input.parsley-error {color: #cf2e2e} #mailpoet_form_1 select.parsley-error {color: #cf2e2e} #mailpoet_form_1 textarea.textarea.parsley-error {color: #cf2e2e} #mailpoet_form_1 .parsley-errors-list {color: #cf2e2e} #mailpoet_form_1 .parsley-required {color: #cf2e2e} #mailpoet_form_1 .parsley-custom-error-message {color: #cf2e2e} #mailpoet_form_1 .mailpoet_paragraph.last {margin-bottom: 0} @media (max-width: 500px) {#mailpoet_form_1 {background-image: none;}} @media (min-width: 500px) {#mailpoet_form_1 .last .mailpoet_paragraph:last-child {margin-bottom: 0}} @media (max-width: 500px) {#mailpoet_form_1 .mailpoet_form_column:last-child .mailpoet_paragraph:last-child {margin-bottom: 0}} </style> <form target="_self" method="post" action="https://wp-firewall.com/wp-admin/admin-post.php?action=mailpoet_subscription_form" class="mailpoet_form mailpoet_form_form mailpoet_form_shortcode" novalidate data-delay="" data-exit-intent-enabled="" data-trigger-mode="" data-click-trigger-selector="" data-font-family="" data-cookie-expiration-time="" > <input type="hidden" name="data[form_id]" value="1" /> <input type="hidden" name="token" value="76a1c8fe3b" /> <input type="hidden" name="api_version" value="v1" /> <input type="hidden" name="endpoint" value="subscribers" /> <input type="hidden" name="mailpoet_method" value="subscribe" /> <label class="mailpoet_hp_email_label" style="display: none !important;">Please leave this field empty<input type="email" name="data[email]"/></label><div class='mailpoet_spacer' style='height: 10px;'></div> <h2 class="mailpoet-heading mailpoet-has-font-size" style="text-align: center; color: #0214d1; font-size: 20px; line-height: 1.5"><span style="font-family: Montserrat" data-font="Montserrat" class="mailpoet-has-font"><strong>Receive WP Security Weekly for Free 👋<br>Signup Now</strong></span>!!</h2> <p class="mailpoet_form_paragraph mailpoet-has-font-size" style="text-align: center; color: #000000; font-size: 14px; line-height: 1.5"><strong><span style="font-family: Montserrat" data-font="Montserrat" class="mailpoet-has-font">Sign up to receive WordPress Security Update in your inbox, every week.</span></strong></p> <div class="mailpoet_paragraph "><input type="email" autocomplete="email" class="mailpoet_text" id="form_email_1" name="data[form_field_NDQyNzVkNWRlYmIxX2VtYWls]" title="Email Address" value="" style="width:100%;box-sizing:border-box;background-color:#f1f1f1;border-style:solid;border-radius:40px !important;border-width:0px;border-color:#313131;padding:15px;margin: 0 auto 0 0;font-family:&#039;Montserrat&#039;;font-size:15px;line-height:1.5;height:auto;" data-automation-id="form_email" placeholder="Email Address *" aria-label="Email Address *" data-parsley-errors-container=".mailpoet_error_rxfmz" data-parsley-required="true" required aria-required="true" data-parsley-minlength="6" data-parsley-maxlength="150" data-parsley-type-message="This value should be a valid email." data-parsley-required-message="This field is required."/><span class="mailpoet_error_rxfmz"></span></div> <div class="mailpoet_paragraph "><input type="submit" class="mailpoet_submit" value="Let’s keep in touch" data-automation-id="subscribe-submit-button" data-font-family='Montserrat' style="width:100%;box-sizing:border-box;background-color:#0214d1;border-style:solid;border-radius:40px !important;border-width:0px;border-color:#313131;padding:15px;margin: 0 auto 0 0;font-family:&#039;Montserrat&#039;;font-size:15px;line-height:1.5;height:auto;color:#ffffff;font-weight:bold;" /><span class="mailpoet_form_loading"><span class="mailpoet_bounce1"></span><span class="mailpoet_bounce2"></span><span class="mailpoet_bounce3"></span></span></div> <p class="mailpoet_form_paragraph mailpoet-has-font-size" style="text-align: center; font-size: 13px; line-height: 1.5"><em>We don’t spam! Read our <a target="_blank" href="https://wp-firewall.com/privacy-policy/">privacy policy</a> for more info.</em></p> <div class="mailpoet_message"> <p class="mailpoet_validate_success" style="display:none;" >Check your inbox or spam folder to confirm your subscription. </p> <p class="mailpoet_validate_error" style="display:none;" > </p> </div> </form> </div> </div></article> </main> </div> </div> </div> <div class="site-footer"> <div class="gb-container gb-container-231dff91"><div class="gb-inside-container"> <h3 class="gb-headline gb-headline-392c1785"><span class="gb-icon"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 8.145 54.189"><path d="M4.262 40.052V0l-.439.438v39.613l.439.001zm-.439 3.853v9.845l.438.438.001-10.284-.439.001zm3.883-11.29v17.518l.439-.439V32.615h-.439zm0-8.273h.439V9.495l-.439-.439v15.286zM.439 21.074V4.056L0 4.495l.001 16.579h.438zm.001 6.274l-.439-.001v19.347l.439.439V27.348z"></path></svg></span></h3> </div></div> <div class="gb-container gb-container-df85b0d1"><div class="gb-inside-container"> <div class="gb-container gb-container-d6d0b9ea"><div class="gb-inside-container"> <div class="gb-grid-wrapper gb-grid-wrapper-eef6e45a"> <div class="gb-grid-column gb-grid-column-14d665b5"><div class="gb-container gb-container-14d665b5"><div class="gb-inside-container"> <h4 class="gb-headline gb-headline-55bf7d89 gb-headline-text">Contact us to schedule a complimentary WordPress Security consultation</h4> </div></div></div> <div class="gb-grid-column gb-grid-column-981e7791"><div class="gb-container gb-container-981e7791"><div class="gb-inside-container"> <div class="gb-button-wrapper gb-button-wrapper-31812854"> <a class="gb-button gb-button-eb30be39" href="https://wp-firewall.com/contact" target="_blank" rel="noopener noreferrer"><span class="gb-button-text">Contact Us</span><span class="gb-icon"><svg viewBox="0 0 16 16" class="bi bi-arrow-right-short" fill="currentColor" height="16" width="16" xmlns="http://www.w3.org/2000/svg"> <path d="M4 8a.5.5 0 0 1 .5-.5h5.793L8.146 5.354a.5.5 0 1 1 .708-.708l3 3a.5.5 0 0 1 0 .708l-3 3a.5.5 0 0 1-.708-.708L10.293 8.5H4.5A.5.5 0 0 1 4 8z" fill-rule="evenodd"></path> </svg></span></a> </div> </div></div></div> </div> </div></div> <div class="gb-grid-wrapper gb-grid-wrapper-1f9744c6"> <div class="gb-grid-column gb-grid-column-67f4907e"><div class="gb-container gb-container-67f4907e"><div class="gb-inside-container"> <figure class="wp-block-image size-full is-resized"><img loading="lazy" decoding="async" width="313" height="313" src="/assets/uploads/2022/11/WP_Firewall-logo_Nov2022-02.png" alt="" class="wp-image-942" style="width:78px;height:78px" srcset"/assets/uploads/2022/11/WP_Firewall-logo_Nov2022-02.png 313w, /assets/uploads/2022/11/WP_Firewall-logo_Nov2022-02-300x300.png 300w, /assets/uploads/2022/11/WP_Firewall-logo_Nov2022-02-150x150.png 150w" sizes="auto, (max-width: 313px) 100vw, 313px" /></figure> </div></div></div> <div class="gb-grid-column gb-grid-column-956cd96f"><div class="gb-container gb-container-956cd96f"><div class="gb-inside-container"> <p class="gb-headline gb-headline-b7fa610a gb-headline-text">WP-Firewall<br>6/F, The Rays, 71 Hung To Road, Kwun Tong, Kowloon, Hong Kong</p> </div></div></div> <div class="gb-grid-column gb-grid-column-dc9b7928"><div class="gb-container gb-container-dc9b7928"><div class="gb-inside-container"> <div class="gb-button-wrapper gb-button-wrapper-4b2e3c63"> <a class="gb-button gb-button-79519911" href="https://wp-firewall.com/services/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Features</span></a> <a class="gb-button gb-button-dda6c846" href="https://wp-firewall.com/pricing/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Pricing</span></a> <a class="gb-button gb-button-94099ac2" href="https://wp-firewall.com/blog/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Blog</span></a> <a class="gb-button gb-button-abee0c2d" href="https://my.wp-firewall.com/" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Login</span></a> </div> <div class="gb-button-wrapper gb-button-wrapper-52987a9b"> <a class="gb-button gb-button-bc169fbc" href="https://www.linkedin.com/company/wp-firewall/" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 448 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M100.28 448H7.4V148.9h92.88zM53.79 108.1C24.09 108.1 0 83.5 0 53.8a53.79 53.79 0 0 1 107.58 0c0 29.7-24.1 54.3-53.79 54.3zM447.9 448h-92.68V302.4c0-34.7-.7-79.2-48.29-79.2-48.29 0-55.69 37.7-55.69 76.7V448h-92.78V148.9h89.08v40.8h1.3c12.4-23.5 42.69-48.3 87.88-48.3 94 0 111.28 61.9 111.28 142.3V448z"></path></svg></span></a> <a class="gb-button gb-button-01beaade" href="https://x.com/WPFirewall" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" role="img" height="1em" width="1em" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M389.2 48h70.6L305.6 224.2 487 464H345L233.7 318.6 106.5 464H35.8L200.7 275.5 26.8 48H172.4L272.9 180.9 389.2 48zM364.4 421.8h39.1L151.1 88h-42L364.4 421.8z"></path></svg></span></a> <a class="gb-button gb-button-95ca849b" href="https://www.facebook.com/profile.php?id=100080056374443" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" role="img" height="1em" width="1em" viewBox="0 0 320 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M279.14 288l14.22-92.66h-88.91v-60.13c0-25.35 12.42-50.06 52.24-50.06h40.42V6.26S260.43 0 225.36 0c-73.22 0-121.08 44.38-121.08 124.72v70.62H22.89V288h81.39v224h100.17V288z"></path></svg></span></a> <a class="gb-button gb-button-b32939b7" href="https://wp-firewall.com/get-a-quote/" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" role="img" height="1em" width="1em" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M464 64H48C21.49 64 0 85.49 0 112v288c0 26.51 21.49 48 48 48h416c26.51 0 48-21.49 48-48V112c0-26.51-21.49-48-48-48zm0 48v40.805c-22.422 18.259-58.168 46.651-134.587 106.49-16.841 13.247-50.201 45.072-73.413 44.701-23.208.375-56.579-31.459-73.413-44.701C106.18 199.465 70.425 171.067 48 152.805V112h416zM48 400V214.398c22.914 18.251 55.409 43.862 104.938 82.646 21.857 17.205 60.134 55.186 103.062 54.955 42.717.231 80.509-37.199 103.053-54.947 49.528-38.783 82.032-64.401 104.947-82.653V400H48z"></path></svg></span></a> </div> </div></div></div> <div class="gb-grid-column gb-grid-column-aa49ddc2"><div class="gb-container gb-container-aa49ddc2"><div class="gb-inside-container"> <div class="gb-button-wrapper gb-button-wrapper-bcad4449"> <a class="gb-button gb-button-ad9b7bcc" href="https://wp-firewall.com/privacy-policy/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Privacy Policy</span></a> <a class="gb-button gb-button-09fece8d" href="https://wp-firewall.com/terms-of-service/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Terms of Service</span></a> <a class="gb-button gb-button-bd070240" href="https://wp-firewall.com/docs/"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Docs</span></a> <a class="gb-button gb-button-1215814a" href="https://wp-firewall.com/affiliate-partnership-application/" target="_blank" rel="noopener noreferrer"><span class="gb-icon"><svg aria-hidden="true" height="1em" width="1em" viewBox="0 0 256 512" xmlns="http://www.w3.org/2000/svg"><path fill="currentColor" d="M224.3 273l-136 136c-9.4 9.4-24.6 9.4-33.9 0l-22.6-22.6c-9.4-9.4-9.4-24.6 0-33.9l96.4-96.4-96.4-96.4c-9.4-9.4-9.4-24.6 0-33.9L54.3 103c9.4-9.4 24.6-9.4 33.9 0l136 136c9.5 9.4 9.5 24.6.1 34z"></path></svg></span><span class="gb-button-text">Affiliate</span></a> </div> <div class="trp-shortcode-switcher__wrapper" style="--bg:#ffffff;--bg-hover:#0000000d;--text:#143852;--text-hover:#1d2327;--border:1px solid #1438521a;--border-width:1px;--border-color:#1438521a;--border-radius:5px;--flag-radius:2px;--flag-size:18px;--aspect-ratio:4/3;--font-size:14px;--transition-duration:0.2s" role="group" data-open-mode="hover"> <!-- ANCHOR (in-flow only; sizing/borders; inert) --> <div class="trp-language-switcher trp-ls-dropdown trp-shortcode-switcher trp-shortcode-anchor trp-open-on-hover" aria-hidden="true" inert data-no-translation> <div class="trp-current-language-item__wrapper"> <a class="trp-language-item trp-language-item__default trp-language-item__current" data-no-translation href="https://wp-firewall.com/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="English"><span class="trp-language-item-name">English</span></a> <svg class="trp-shortcode-arrow" width="20" height="20" viewBox="0 0 20 21" fill="none" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg"> <path d="M5 8L10 13L15 8" stroke="var(--text)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg> </div> </div> <!-- OVERLAY (positioned; interactive surface) --> <div class="trp-language-switcher trp-ls-dropdown trp-shortcode-switcher trp-shortcode-overlay trp-open-on-hover" role="navigation" aria-label="Website language selector" data-no-translation > <div class="trp-current-language-item__wrapper"> <div class="trp-language-item trp-language-item__default trp-language-item__current" data-no-translation role="button" aria-expanded="false" tabindex="0" aria-label="Change language" aria-controls="trp-shortcode-dropdown-6a8b1ddcb8a94"><span class="trp-language-item-name">English</span></div> <svg class="trp-shortcode-arrow" width="20" height="20" viewBox="0 0 20 21" fill="none" aria-hidden="true" focusable="false" xmlns="http://www.w3.org/2000/svg"> <path d="M5 8L10 13L15 8" stroke="var(--text)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/> </svg> </div> <div class="trp-switcher-dropdown-list" id="trp-shortcode-dropdown-6a8b1ddcb8a94" role="group" aria-label="Available languages" hidden inert > <a class="trp-language-item" href="https://wp-firewall.com/zh_cn/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="简体中文"> <span class="trp-language-item-name" data-no-translation>简体中文</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/zh_hk/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="香港中文"> <span class="trp-language-item-name" data-no-translation>香港中文</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/zh_tw/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="繁體中文"> <span class="trp-language-item-name" data-no-translation>繁體中文</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/ja/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="日本語"> <span class="trp-language-item-name" data-no-translation>日本語</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/es/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Español"> <span class="trp-language-item-name" data-no-translation>Español</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/fr/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Français"> <span class="trp-language-item-name" data-no-translation>Français</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/ar/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="العربية"> <span class="trp-language-item-name" data-no-translation>العربية</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/hi/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="हिन्दी"> <span class="trp-language-item-name" data-no-translation>हिन्दी</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/bn/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="বাংলা"> <span class="trp-language-item-name" data-no-translation>বাংলা</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/ko/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="한국어"> <span class="trp-language-item-name" data-no-translation>한국어</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/it/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Italiano"> <span class="trp-language-item-name" data-no-translation>Italiano</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/pt/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Português"> <span class="trp-language-item-name" data-no-translation>Português</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/nl/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Nederlands"> <span class="trp-language-item-name" data-no-translation>Nederlands</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/vi/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Tiếng Việt"> <span class="trp-language-item-name" data-no-translation>Tiếng Việt</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/ru/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Русский"> <span class="trp-language-item-name" data-no-translation>Русский</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/pl/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Polski"> <span class="trp-language-item-name" data-no-translation>Polski</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/de/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Deutsch"> <span class="trp-language-item-name" data-no-translation>Deutsch</span> </a> <a class="trp-language-item" href="https://wp-firewall.com/da/security-advisory-xss-in-wpdatatables-plugin-published-on-2026-04-20-cve-2026-5721/" title="Dansk"> <span class="trp-language-item-name" data-no-translation>Dansk</span> </a> </div> </div> </div> </div></div></div> </div> <p class="gb-headline gb-headline-bb5da184 gb-headline-text">© 2026 WP-Firewall™</p> </div></div></div> <nav id="generate-slideout-menu" class="main-navigation slideout-navigation" itemtype="https://schema.org/SiteNavigationElement" itemscope> <div class="inside-navigation grid-container grid-parent"> <button class="slideout-exit has-svg-icon"><span class="gp-icon pro-close"> <svg viewBox="0 0 512 512" aria-hidden="true" role="img" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="1em" height="1em"> <path d="M71.029 71.029c9.373-9.372 24.569-9.372 33.942 0L256 222.059l151.029-151.03c9.373-9.372 24.569-9.372 33.942 0 9.372 9.373 9.372 24.569 0 33.942L289.941 256l151.03 151.029c9.372 9.373 9.372 24.569 0 33.942-9.373 9.372-24.569 9.372-33.942 0L256 289.941l-151.029 151.03c-9.373 9.372-24.569 9.372-33.942 0-9.372-9.373-9.372-24.569 0-33.942L222.059 256 71.029 104.971c-9.372-9.373-9.372-24.569 0-33.942z" /> </svg> </span> <span class="screen-reader-text">Close</span></button><div class="main-nav"><ul id="menu-main-menu-1" class=" slideout-menu"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1652"><a href="https://wp-firewall.com/features/">Features</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1024"><a href="https://wp-firewall.com/pricing/">Pricing</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page current_page_parent menu-item-162"><a href="https://wp-firewall.com/blog/">Blog</a></li> <li class="menu-item menu-item-type-post_type_archive menu-item-object-docs menu-item-has-children menu-item-1077"><a href="https://wp-firewall.com/docs/">Docs<span role="presentation" class="dropdown-menu-toggle"><span class="gp-icon icon-arrow"><svg viewBox="0 0 330 512" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="1em" height="1em"><path d="M305.913 197.085c0 2.266-1.133 4.815-2.833 6.514L171.087 335.593c-1.7 1.7-4.249 2.832-6.515 2.832s-4.815-1.133-6.515-2.832L26.064 203.599c-1.7-1.7-2.832-4.248-2.832-6.514s1.132-4.816 2.832-6.515l14.162-14.163c1.7-1.699 3.966-2.832 6.515-2.832 2.266 0 4.815 1.133 6.515 2.832l111.316 111.317 111.316-111.317c1.7-1.699 4.249-2.832 6.515-2.832s4.815 1.133 6.515 2.832l14.162 14.163c1.7 1.7 2.833 4.249 2.833 6.515z" /></svg></span></span></a> <ul class="sub-menu"> <li class="menu-item menu-item-type-post_type menu-item-object-docs menu-item-1078"><a href="https://wp-firewall.com/docs/how-to-install-wp-firewall-free-plan/">Docs &#8211; How to install WP-Firewall free plan?</a></li> </ul> </li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-667"><a href="https://wp-firewall.com/about/">About<span role="presentation" class="dropdown-menu-toggle"><span class="gp-icon icon-arrow"><svg viewBox="0 0 330 512" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="1em" height="1em"><path d="M305.913 197.085c0 2.266-1.133 4.815-2.833 6.514L171.087 335.593c-1.7 1.7-4.249 2.832-6.515 2.832s-4.815-1.133-6.515-2.832L26.064 203.599c-1.7-1.7-2.832-4.248-2.832-6.514s1.132-4.816 2.832-6.515l14.162-14.163c1.7-1.699 3.966-2.832 6.515-2.832 2.266 0 4.815 1.133 6.515 2.832l111.316 111.317 111.316-111.317c1.7-1.699 4.249-2.832 6.515-2.832s4.815 1.133 6.515 2.832l14.162 14.163c1.7 1.7 2.833 4.249 2.833 6.515z" /></svg></span></span></a> <ul class="sub-menu"> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1258"><a href="https://wp-firewall.com/get-a-quote/">Get A Quote</a></li> <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-1291"><a href="https://wp-firewall.com/affiliate-partnership-application/">Affiliate</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1257"><a href="https://wp-firewall.com/contact/">Contact Us</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-privacy-policy menu-item-1025"><a rel="privacy-policy" href="https://wp-firewall.com/privacy-policy/">Privacy Policy</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1026"><a href="https://wp-firewall.com/cookie-policy/">Cookie Policy</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1027"><a href="https://wp-firewall.com/terms-of-service/">Terms of Service</a></li> </ul> </li> <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-has-children menu-item-1240"><a href="https://my.wp-firewall.com">Login<span role="presentation" class="dropdown-menu-toggle"><span class="gp-icon icon-arrow"><svg viewBox="0 0 330 512" aria-hidden="true" xmlns="http://www.w3.org/2000/svg" width="1em" height="1em"><path d="M305.913 197.085c0 2.266-1.133 4.815-2.833 6.514L171.087 335.593c-1.7 1.7-4.249 2.832-6.515 2.832s-4.815-1.133-6.515-2.832L26.064 203.599c-1.7-1.7-2.832-4.248-2.832-6.514s1.132-4.816 2.832-6.515l14.162-14.163c1.7-1.699 3.966-2.832 6.515-2.832 2.266 0 4.815 1.133 6.515 2.832l111.316 111.317 111.316-111.317c1.7-1.699 4.249-2.832 6.515-2.832s4.815 1.133 6.515 2.832l14.162 14.163c1.7 1.7 2.833 4.249 2.833 6.515z" /></svg></span></span></a> <ul class="sub-menu"> <li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-1304"><a href="https://my.wp-firewall.com/buy/wp-firewall-free-plan/">Signup</a></li> <li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1377"><a href="https://wp-firewall.com/wp-security-weekly-update-monthly-subscription-with-15-days-free-trial/">Signup 15 Days Free &#8211; WP Security Weekly Update</a></li> </ul> </li> </ul></div> </div><!-- .inside-navigation --> </nav><!-- #site-navigation --> <div class="slideout-overlay"> </div> <template id="tp-language" data-tp-language="en_US"></template><script type="speculationrules"> {"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["/wp-*.php","/wp-admin/*","/wp-content/uploads/*","/wp-content/*","/wp-content/plugins/*","/wp-content/themes/generatepress/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]} </script> <script id="independent-analytics-script" type="295c68f3054b91c077c32ba1-text/javascript"> // Do not change this comment line otherwise Speed Optimizer won't be able to detect this script (function () { function sendRequest(url, body) { if(!window.fetch) { const xhr = new XMLHttpRequest(); xhr.open("POST", url, true); xhr.setRequestHeader("Content-Type", "application/json;charset=UTF-8"); xhr.send(JSON.stringify(body)) return } const request = fetch(url, { method: 'POST', body: JSON.stringify(body), keepalive: true, headers: { 'Content-Type': 'application/json;charset=UTF-8' } }); } const calculateParentDistance = (child, parent) => { let count = 0; let currentElement = child; // Traverse up the DOM tree until we reach parent or the top of the DOM while (currentElement && currentElement !== parent) { currentElement = currentElement.parentNode; count++; } // If parent was not found in the hierarchy, return -1 if (!currentElement) { return -1; // Indicates parent is not an ancestor of element } return count; // Number of layers between element and parent } const isMatchingClass = (linkRule, href, classes, ids) => { return classes.includes(linkRule.value) } const isMatchingId = (linkRule, href, classes, ids) => { return ids.includes(linkRule.value) } const isMatchingDomain = (linkRule, href, classes, ids) => { if(!URL.canParse(href)) { return false } const url = new URL(href) const host = url.host const hostsToMatch = [host] if(host.startsWith('www.')) { hostsToMatch.push(host.substring(4)) } else { hostsToMatch.push('www.' + host) } return hostsToMatch.includes(linkRule.value) } const isMatchingExtension = (linkRule, href, classes, ids) => { if(!URL.canParse(href)) { return false } const url = new URL(href) return url.pathname.endsWith('.' + linkRule.value) } const isMatchingSubdirectory = (linkRule, href, classes, ids) => { if(!URL.canParse(href)) { return false } const url = new URL(href) return url.pathname.startsWith('/' + linkRule.value + '/') } const isMatchingProtocol = (linkRule, href, classes, ids) => { if(!URL.canParse(href)) { return false } const url = new URL(href) return url.protocol === linkRule.value + ':' } const isMatchingExternal = (linkRule, href, classes, ids) => { if(!URL.canParse(href) || !URL.canParse(document.location.href)) { return false } const matchingProtocols = ['http:', 'https:'] const siteUrl = new URL(document.location.href) const linkUrl = new URL(href) // Links to subdomains will appear to be external matches according to JavaScript, // but the PHP rules will filter those events out. return matchingProtocols.includes(linkUrl.protocol) && siteUrl.host !== linkUrl.host } const isMatch = (linkRule, href, classes, ids) => { switch (linkRule.type) { case 'class': return isMatchingClass(linkRule, href, classes, ids) case 'id': return isMatchingId(linkRule, href, classes, ids) case 'domain': return isMatchingDomain(linkRule, href, classes, ids) case 'extension': return isMatchingExtension(linkRule, href, classes, ids) case 'subdirectory': return isMatchingSubdirectory(linkRule, href, classes, ids) case 'protocol': return isMatchingProtocol(linkRule, href, classes, ids) case 'external': return isMatchingExternal(linkRule, href, classes, ids) default: return false; } } const track = (element) => { const href = element.href ?? null const classes = Array.from(element.classList) const ids = [element.id] const linkRules = [{"type":"extension","value":"pdf"},{"type":"extension","value":"zip"},{"type":"protocol","value":"mailto"},{"type":"protocol","value":"tel"}] if(linkRules.length === 0) { return } // For link rules that target an id, we need to allow that id to appear // in any ancestor up to the 7th ancestor. This loop looks for those matches // and counts them. linkRules.forEach((linkRule) => { if(linkRule.type !== 'id') { return; } const matchingAncestor = element.closest('#' + linkRule.value) if(!matchingAncestor || matchingAncestor.matches('html, body')) { return; } const depth = calculateParentDistance(element, matchingAncestor) if(depth < 7) { ids.push(linkRule.value) } }); // For link rules that target a class, we need to allow that class to appear // in any ancestor up to the 7th ancestor. This loop looks for those matches // and counts them. linkRules.forEach((linkRule) => { if(linkRule.type !== 'class') { return; } const matchingAncestor = element.closest('.' + linkRule.value) if(!matchingAncestor || matchingAncestor.matches('html, body')) { return; } const depth = calculateParentDistance(element, matchingAncestor) if(depth < 7) { classes.push(linkRule.value) } }); const hasMatch = linkRules.some((linkRule) => { return isMatch(linkRule, href, classes, ids) }) if(!hasMatch) { return } const url = "https://wp-firewall.com/wp-content/plugins/independent-analytics-pro/iawp-click-endpoint.php"; const body = { href: href, classes: classes.join(' '), ids: ids.join(' '), ...{"payload":{"resource":"singular","singular_id":6584,"page":1},"signature":"29fab4cdb26bc9bf128cd6558d332365"} }; sendRequest(url, body) } let hasSearched = false; function search() { if(hasSearched) { return; } hasSearched = true; if (document.hasOwnProperty("visibilityState") && document.visibilityState === "prerender") { return; } if (navigator.webdriver || /bot|crawler|spider|crawling|semrushbot|chrome-lighthouse/i.test(navigator.userAgent)) { return; } let referrer_url = null; if (typeof document.referrer === 'string' && document.referrer.length > 0) { referrer_url = document.referrer; } const params = location.search.slice(1).split('&').reduce((acc, s) => { const [k, v] = s.split('='); return Object.assign(acc, {[k]: v}); }, {}); const url = "https://wp-firewall.com/wp-json/iawp/search"; const body = { referrer_url, utm_source: params.utm_source, utm_medium: params.utm_medium, utm_campaign: params.utm_campaign, utm_term: params.utm_term, utm_content: params.utm_content, gclid: params.gclid, ...{"payload":{"resource":"singular","singular_id":6584,"page":1},"signature":"29fab4cdb26bc9bf128cd6558d332365"} }; sendRequest(url, body) } document.addEventListener('mousedown', function (event) { if (navigator.webdriver || /bot|crawler|spider|crawling|semrushbot|chrome-lighthouse/i.test(navigator.userAgent)) { return; } const element = event.target.closest('a') if(!element) { return } const isPro = true if(!isPro) { return } // Don't track left clicks with this event. The click event is used for that. if(event.button === 0) { return } track(element) }) document.addEventListener('click', function (event) { if (navigator.webdriver || /bot|crawler|spider|crawling|semrushbot|chrome-lighthouse/i.test(navigator.userAgent)) { return; } const element = event.target.closest('a, button, input[type="submit"], input[type="button"]') if(!element) { return } const isPro = true if(!isPro) { return } track(element) }) document.addEventListener('play', function (event) { if (navigator.webdriver || /bot|crawler|spider|crawling|semrushbot|chrome-lighthouse/i.test(navigator.userAgent)) { return; } const element = event.target.closest('audio, video') if(!element) { return } const isPro = true if(!isPro) { return } track(element) }, true) document.addEventListener("DOMContentLoaded", function (e) { search(); }); document.addEventListener("iawpSearch", function (e) { search(); }); })(); </script> <script type="295c68f3054b91c077c32ba1-text/javascript">document.querySelectorAll('.playHtListenArea').forEach(function(el) {el.style.display = 'block'});</script> <script type="295c68f3054b91c077c32ba1-text/javascript"> var _paq = _paq || []; _paq.push(['setCustomDimension', 1, '{"ID":1,"name":"WP-FIREWALL SECURITY TEAM","avatar":"c55b9a07a5b2ac6d76d736e92833a232"}']); _paq.push(['trackPageView']); (function () { var u = "https://analytics1.wpmudev.com/"; _paq.push(['setTrackerUrl', u + 'track/']); _paq.push(['setSiteId', '16840']); var d = document, g = d.createElement('script'), s = d.getElementsByTagName('script')[0]; g.type = 'text/javascript'; g.async = true; g.defer = true; g.src = 'https://analytics.wpmucdn.com/matomo.js'; s.parentNode.insertBefore(g, s); })(); </script> <script id="generate-a11y" type="295c68f3054b91c077c32ba1-text/javascript"> !function(){"use strict";if("querySelector"in document&&"addEventListener"in window){var e=document.body;e.addEventListener("pointerdown",(function(){e.classList.add("using-mouse")}),{passive:!0}),e.addEventListener("keydown",(function(){e.classList.remove("using-mouse")}),{passive:!0})}}(); </script> <script id="imagesloaded-js" src="https://wp-firewall.com/wp-includes/js/imagesloaded.min.js?ver=5.0.0" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="masonry-js" src="https://wp-firewall.com/wp-includes/js/masonry.min.js?ver=4.2.2" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="betterdocs-categorygrid-js" src="https://wp-firewall.com/wp-content/plugins/betterdocs/assets/blocks/categorygrid/frontend.js?ver=a4a7e7ed1fd9a2aaf85a" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="generate-offside-js-extra" type="295c68f3054b91c077c32ba1-text/javascript"> var offSide = {"side":"right"}; //# sourceURL=generate-offside-js-extra </script> <script id="generate-offside-js" src="https://wp-firewall.com/wp-content/plugins/gp-premium/menu-plus/functions/js/offside.min.js?ver=2.5.5" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="betterlinks-app-js-extra" type="295c68f3054b91c077c32ba1-text/javascript"> var betterLinksApp = {"betterlinks_nonce":"8aa37a2d44","ajaxurl":"https://wp-firewall.com/wp-admin/admin-ajax.php","site_url":"https://wp-firewall.com","rest_url":"https://wp-firewall.com/wp-json/","nonce":"9e48b1bf7b","betterlinkspro_version":"2.5.0"}; //# sourceURL=betterlinks-app-js-extra </script> <script id="betterlinks-app-js" src="https://wp-firewall.com/wp-content/plugins/betterlinks/assets/js/betterlinks.app.core.min.js?ver=82f05e9a0c750678d3cc" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="generate-menu-js-before" type="295c68f3054b91c077c32ba1-text/javascript"> var generatepressMenu = {"toggleOpenedSubMenus":true,"openSubMenuLabel":"Open Sub-Menu","closeSubMenuLabel":"Close Sub-Menu"}; //# sourceURL=generate-menu-js-before </script> <script id="generate-menu-js" src="https://wp-firewall.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.6.1" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="googlesitekit-consent-mode-js" src="https://wp-firewall.com/wp-content/plugins/google-site-kit/dist/assets/js/googlesitekit-consent-mode-bc2e26cfa69fcd4a8261.js" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="wp-consent-api-js-extra" type="295c68f3054b91c077c32ba1-text/javascript"> var consent_api = {"consent_type":"","waitfor_consent_hook":"","cookie_expiration":"30","cookie_prefix":"wp_consent","services":[{"name":"WPMUDEV Dashboard","category":"statistics"}]}; //# sourceURL=wp-consent-api-js-extra </script> <script id="wp-consent-api-js" src="https://wp-firewall.com/wp-content/plugins/wp-consent-api/assets/js/wp-consent-api.min.js?ver=2.0.0" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="mailpoet_public-js-extra" type="295c68f3054b91c077c32ba1-text/javascript"> var MailPoetForm = {"ajax_url":"https://wp-firewall.com/wp-admin/admin-ajax.php","is_rtl":"","ajax_common_error_message":"An error has happened while performing a request, please try again later.","captcha_input_label":"Type in the characters you see in the picture above:","captcha_reload_title":"Reload CAPTCHA","captcha_audio_title":"Play CAPTCHA","assets_url":"https://wp-firewall.com/wp-content/plugins/mailpoet/assets","collect_subscriber_timezones":"1"}; //# sourceURL=mailpoet_public-js-extra </script> <script data-wp-strategy="defer" defer id="mailpoet_public-js" src="https://wp-firewall.com/wp-content/plugins/mailpoet/assets/dist/js/public.js?ver=5.27.0" type="295c68f3054b91c077c32ba1-text/javascript"></script> <script id="wp-emoji-settings" type="application/json"> {"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://wp-firewall.com/wp-includes/js/wp-emoji-release.min.js?ver=7.1"}} </script> <script type="295c68f3054b91c077c32ba1-module"> /*! This file is auto-generated */ var e="script#wp-emoji-settings",t=document.querySelector(e);if(!(t instanceof HTMLScriptElement))throw new Error("Element missing: "+e);const r=JSON.parse(t.text),s=(window._wpemojiSettings=r,"wpEmojiSettingsSupports"),o=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(s,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const r=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===r[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,r){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!r(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,r){let a;const s=(a="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),o=(s.textBaseline="top",s.font="600 32px Arial",{});return e.forEach(e=>{o[e]=t(s,e,n,r)}),o}function a(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}r.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(s));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(o),u.toString(),c.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"});const a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=e=>{i(n=e.data),a.terminate(),t(n)})}catch(e){}i(n=f(o,u,c,p))}t(n)}).then(e=>{for(const n in e)r.supports[n]=e[n],r.supports.everything=r.supports.everything&&r.supports[n],"flag"!==n&&(r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&r.supports[n]);var t;r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&!r.supports.flag,r.supports.everything||((t=r.source||{}).concatemoji?a(t.concatemoji):t.wpemoji&&t.twemoji&&(a(t.twemoji),a(t.wpemoji)))}); //# sourceURL=https://wp-firewall.com/wp-includes/js/wp-emoji-loader.min.js </script> <!-- Usermaven - privacy-friendly analytics tool --> <script type="295c68f3054b91c077c32ba1-text/javascript"> (function () { window.usermaven = window.usermaven || (function () { (window.usermavenQ = window.usermavenQ || []).push(arguments); }) var t = document.createElement('script'), s = document.getElementsByTagName('script')[0]; t.defer = true; t.id = 'um-tracker'; t.setAttribute('data-tracking-host', 'https://u.wp-firewall.com'); t.setAttribute('data-key', 'UMZJ8b2F3H'); t.setAttribute('data-autocapture', 'true'); t.setAttribute('data-randomize-url', 'true'); t.src = 'https://u.wp-firewall.com/lib.js'; s.parentNode.insertBefore(t, s); })(); </script> <!-- / Usermaven --> <script src="/cdn-cgi/scripts/7d0fa10a/cloudflare-static/rocket-loader.min.js" data-cf-settings="295c68f3054b91c077c32ba1-|49" defer></script><script type="module" src="https://static.cloudflareinsights.com/beacon.min.js/v4513226cdae34746b4dedf0b4dfa099e1781791509496" integrity="sha512-ZE9pZaUXND66v380QUtch/5sE9tPFh2zg45pR2PB0CVkCtOREv2AJKkSidISWkysEuQ0EH8faUU5du78bx87UQ==" data-cf-beacon='{"version":"2024.11.0","token":"d5aa7aab42e44391befc9d4326f845dc","r":1}' crossorigin="anonymous"></script> </body> </html> <!-- Performance optimized by Redis Object Cache. Learn more: https://wprediscache.com Retrieved 10906 objects (2 MB) from Redis using PhpRedis (v6.1.0). -->