Skip to main content

Ninja Tables EUVDEUVD-2026-53959

| CVE-2026-61964 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-08-06 Patchstack GHSA-qqc7-4x28-7p78
XSS Ninja Tables
7.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
vuln.today AI
6.1 MEDIUM

Unauthenticated network XSS with scope change to browser; no availability impact applies to script injection without denial-of-service capability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
Analysis Generated
Aug 06, 2026 - 15:24 vuln.today
CVE Published
Aug 06, 2026 - 14:27 cve.org
HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site running Ninja Tables ≤5.2.9
Delivery
Inject XSS payload via unauthenticated input vector
Exploit
Craft delivery link or poisoned table URL
Execution
Lure privileged user to trigger payload
Persist
JavaScript executes in victim browser
Impact
Exfiltrate session token or perform admin actions
Sign in to reveal

Vulnerability AssessmentAI

Exploitation No authentication is required on the attacker's part (PR:N), meaning any unauthenticated internet visitor can submit or craft the malicious input. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS base score of 7.1 (High) reflects the combination of network accessibility, no required privileges, and cross-scope impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a WordPress site running Ninja Tables 5.2.9 or earlier and injects a JavaScript payload into a table field or URL parameter that the plugin renders without sanitization. The attacker then social-engineers an administrator - for example via a phishing email containing a link to the affected page - to visit the poisoned URL or table view, causing the script to execute in the admin's browser, steal their session cookie, and transmit it to an attacker-controlled server, resulting in full WordPress site compromise. …
Remediation The primary fix is to update the Ninja Tables plugin to a version beyond 5.2.9 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Conduct inventory scan to identify all WordPress instances running Ninja Tables plugin versions 5.2.9 or earlier and document their criticality; disable the plugin on non-production or non-essential systems pending patch availability; restrict administrative user access to plugin configuration. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Ninja Tables

View all
CVE-2025-2940 HIGH
7.2 Jun 27

The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all vers
CVE-2025-2939 MEDIUM
5.6 Jun 03

The Ninja Tables - Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up
CVE-2024-7304 MEDIUM
5.4 Aug 27

The Ninja Tables - Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG

CVE-2026-65474 MEDIUM
5.3 Jul 23

Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthent
CVE-2024-23504 MEDIUM
5.3 Jun 14

Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.0.5. Rated medium severity (CVSS 5.3), this vulner
CVE-2024-35635 MEDIUM
4.9 Jun 03

Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.0.9. Rated medium severity (CVSS 4.9)
CVE-2024-23503 MEDIUM
4.3 Jun 11

Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.0.6. Rated medium severity (CVSS 4.3), this vulner
CVE-2024-12772 MEDIUM POC
5.4 Jan 31

The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in th

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

EUVD-2026-53959 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy