CVE-2026-86612
MediumCVSS 5.6Summary
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
Risk Assessment
An attacker can execute arbitrary shortcodes, potentially leading to unauthorized actions on the site and even permanent damage to the page, affecting availability and integrity.
Recommendation
Update the Ninja Tables plugin to version 5.2.17 or later, which includes a fix to restrict shortcode expansion to trusted rows.
Other vulnerabilities in Ninja Tables
See all- CVE-2026-65474Medium
The Ninja Tables plugin version 5.2.10 and earlier allows unauthenticated attackers to access sensitive data. The vulnerability is due to a lack of proper data protection against unauthorized reading.
- CVE-2026-61964High
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables versions up to and including 5.2.9.
Original NVD description (English source)
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.