vTables – Data Table Builder for CSV, Excel & JSON
vTables – Data Table Builder for CSV, Excel & JSON has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Improper Neutralization Of Special Elements Used In An SQL Command, behind 1 of the records (100%).
The one issue recorded for vTables – Data Table Builder for CSV, Excel & JSON has a vendor fix available, so running the current release closes it.
All of these findings were reported by Pablo González Pérez. vTables – Data Table Builder for CSV, Excel & JSON is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-89216vTables <= 0.2 - Unauthenticated SQL Injection
Read the full analysisVulnerability Records

vTables – Data Table Builder for CSV, Excel & JSON
Author
vTables | Table Builder for WordPress
vTables is a table plugin for WordPress that turns CSV files, Excel spreadsheets (XLS, XLSX) and JSON data into clean, responsive data tables. Import a file or start from an empty grid, edit cells right in the WordPress admin like a spreadsheet, style the table, and embed it on any page or post with a shortcode. Use it for price lists, product catalogs, event schedules, staff and member directories, sports results, comparison tables and any other data you keep in a spreadsheet. Website | User Guide | FAQ Features Import CSV, JSON, XLS and XLSX files (large files are uploaded in chunks and imported in the background). Build tables from scratch: set the number of columns and rows, then fill the cells in. Spreadsheet-like table editor: double-click any cell or header to edit it; add, rename and delete rows and columns from the right-click menu. Unlimited tables, and as many tables per page as you like. Shortcode embed: [vtables id="1"] shows the table; [vtables id="1" row="2" column="email"] prints a single cell value inside your text. Smart cells: image URLs become thumbnails, links become clickable, <button href="…">Label</button> becomes a button, and basic HTML (links, images, line breaks) is rendered safely. Style: colors for the title bar, header, body, pagination bar, links and buttons; dense and flat layouts; row/column separators; sticky header; table height and maximum width. Pagination for large tables: rows are loaded page by page from the database, so tables with many thousands of rows stay fast. Mobile friendly: tables use the width of the content area (with an optional maximum width), and wide tables scroll sideways on small screens. Export any table as CSV, JSON or XLSX. Works with the block editor, classic editor and page builders that accept shortcodes (Divi, Elementor, WPBakery, …). Translated into English, German, Spanish, French, Hindi, Italian, Norwegian, Portuguese, Russian, Swedish, Turkish and Chinese. vTables Pro vTables Pro is a separate, paid add-on that runs on top of this plugin and uses the same tables. It adds: Data sources: Google Sheets, external CSV/JSON URLs and WooCommerce product tables, with automatic sync. Visitor tools: search, sorting and row filters. Layout: column visibility, sticky first/last column, column widths, grouped headers, responsive card view, rows per page, custom CSS. More cell formats: video, PDF, audio, Google Maps, star rating, progress bar and JSON. This plugin is fully functional on its own and never requires Pro. Source code The admin screen and the embedded table are a Vue application. Its complete, unminified source ships with the plugin in the src/ folder, together with the build setup (package.json, quasar.config.js, scripts/). To rebuild: npm ci && npm run build (PHP dependencies: composer install --no-dev). vTables does not track users and makes no requests to external services. The only external links in the admin are to vtables.pro, and they open only when you click them.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C