CVE-2026-61964
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables versions up to and including 5.2.9.
Risk Assessment
An attacker can inject malicious script, potentially leading to data theft or session hijacking.
Recommendation
Update the Ninja Tables plugin to the latest version that includes the security fix.
Other vulnerabilities in Ninja Tables
See all- CVE-2026-86612Medium
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
- CVE-2026-65474Medium
The Ninja Tables plugin version 5.2.10 and earlier allows unauthenticated attackers to access sensitive data. The vulnerability is due to a lack of proper data protection against unauthorized reading.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS