What is the CVSS score of CVE-2026-61964?

CVE-2026-61964 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Ninja Tables are affected by CVE-2026-61964?

Ninja Tables WordPress plugin versions 5.2.9 and earlier contain a cross-site scripting vulnerability exploitable by any unauthenticated attacker, creating substantial risk of credential theft and…

How to fix or mitigate CVE-2026-61964?

Within 24 hours: Conduct inventory scan to identify all WordPress instances running Ninja Tables plugin versions 5.2.9 or earlier and document their criticality; disable the plugin on non-production or non-essential systems pending patch availability; restrict administrative user access to plugin configuration. Within 7 days: Deploy WAF rules and content security policies to mitigate XSS payload execution; configure enhanced logging and alerting on plugin endpoints to detect exploitation attempts; brief stakeholders on risk and interim control measures. Within 30 days: Establish daily monitoring of Ninja Tables vendor communications and security mailing lists for patch announcements; stage patch in pre-production environment immediately upon release; execute prioritized deployment across all affected production systems within 48 hours of patch availability.

Ninja Tables CVE-2026-61964

EUVD-2026-53959 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-qqc7-4x28-7p78

XSS Ninja Tables

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS with scope change to browser; no availability impact applies to script injection without denial-of-service capability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:24 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site running Ninja Tables ≤5.2.9

Delivery

Inject XSS payload via unauthenticated input vector

Exploit

Craft delivery link or poisoned table URL

Execution

Lure privileged user to trigger payload

Persist

JavaScript executes in victim browser

Impact

Exfiltrate session token or perform admin actions