What is the CVSS score of EUVD-2026-53959?

EUVD-2026-53959 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Ninja Tables are affected by EUVD-2026-53959?

Ninja Tables WordPress plugin versions 5.2.9 and earlier contain a cross-site scripting vulnerability exploitable by any unauthenticated attacker, creating substantial risk of credential theft and…

How to fix or mitigate EUVD-2026-53959?

Within 24 hours: Conduct inventory scan to identify all WordPress instances running Ninja Tables plugin versions 5.2.9 or earlier and document their criticality; disable the plugin on non-production or non-essential systems pending patch availability; restrict administrative user access to plugin configuration. Within 7 days: Deploy WAF rules and content security policies to mitigate XSS payload execution; configure enhanced logging and alerting on plugin endpoints to detect exploitation attempts; brief stakeholders on risk and interim control measures. Within 30 days: Establish daily monitoring of Ninja Tables vendor communications and security mailing lists for patch announcements; stage patch in pre-production environment immediately upon release; execute prioritized deployment across all affected production systems within 48 hours of patch availability.

Ninja Tables EUVD-2026-53959

| CVE-2026-61964 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-qqc7-4x28-7p78

WordPress XSS Ninja Tables Wordpress Plugin Wpmanageninja

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS with scope change to browser; no availability impact applies to script injection without denial-of-service capability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:24 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.

AnalysisAI

Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.

Technical ContextAI

Ninja Tables is a WordPress table-builder plugin developed by WPManageNinja (CPE: cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:*:*:*). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is rendered into HTML output without adequate sanitization or output encoding. Because the CVSS vector carries S:C (Scope Changed), the injected payload executes in a security context distinct from the server-side plugin - typically the victim's browser - allowing the attacker to operate under the victim's identity. The unauthenticated nature (PR:N) implies the vulnerable input vector is accessible to any site visitor, not just registered users, consistent with a publicly reachable table display or input field that does not enforce authentication before processing.

RemediationAI

The primary fix is to update the Ninja Tables plugin to a version beyond 5.2.9 via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. The exact patched version number is not confirmed from the available input data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/ninja-tables/vulnerability/wordpress-ninja-tables-plugin-5-2-9-cross-site-scripting-xss-vulnerability for the confirmed fix version before deploying. As a compensating control prior to patching, administrators should restrict table editing and input capabilities to authenticated and trusted users only, and consider temporarily deactivating the plugin on publicly accessible forms or display pages if unauthenticated user input feeds into table rendering. A Web Application Firewall (WAF) with XSS filtering rules, such as those provided by Wordfence or Patchstack's virtual patching feature, can block exploit attempts at the network layer, though this should not substitute for the vendor patch.