Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · ninja-tables
ninja-tables
18 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 23, 2026Ninja Tables: Does not restrict shortcode expansion to administrator-authored table rows whichCVE-2026-86612 · fixed in 5.2.17 · reported by WPScanMedium 5.6
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
Aug 13, 2026Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server.CVE-2026-73533 · reported by VulnCheckCritical 9.3
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.
Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.CVE-2026-61964 · affects up to 5.2.9 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Jul 23, 2026Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.CVE-2026-65474 · affects up to 5.2.10 · reported by PatchstackMedium 5.3
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
May 6, 2026Ninja Tables – Easy Data Table Builder: Unauthorized database table creationCVE-2026-2306 · affects up to 5.2.6 · reported by WordfenceMedium 4.3
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the `createFluentCartTable` function in all versions up to, and including, 5.2.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary Ninja Tables in the database which can lead to database pollution and resource exhaustion.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Ninja Tables: Insertion of Sensitive Information Into Sent DataCVE-2026-25008 · affects up to 5.2.5 · reported by PatchstackMedium 4.3
Insertion of Sensitive Information Into Sent Data vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Retrieve Embedded Sensitive Data.This issue affects Ninja Tables: from n/a through <= 5.2.5.
Jan 6, 2026Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-69351 · affects up to 5.2.4 · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows Blind SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.4.
Dec 9, 2025Ninja Tables: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-67519 · affects up to 5.2.3 · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Ninja Tables ninja-tables allows SQL Injection.This issue affects Ninja Tables: from n/a through <= 5.2.3.
Jun 27, 2025Ninja Tables – Easy Data Table Builder: Server-Side Request ForgeryCVE-2025-2940 · affects up to 5.0.18 · reported by WordfenceHigh 7.2
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 2, 2025Ninja Tables – Easy Data Table Builder: PHP Object InjectionCVE-2025-2939 · affects up to 5.0.18 · reported by WordfenceMedium 5.6
The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 31, 2025Ninja Tables: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2024-12772 · fixed in 5.0.17 · reported by WPScanMedium 5.4
The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability.
Aug 27, 2024Ninja Tables – Easiest Data Table Builder: Stored Cross-Site ScriptingCVE-2024-7304 · affects up to 5.0.12 · reported by WordfenceMedium 6.4
The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 14, 2024Ninja Tables: Missing AuthorizationCVE-2024-23504 · affects up to 5.0.5 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5.
Jun 11, 2024Ninja Tables: Missing AuthorizationCVE-2024-23503 · affects up to 5.0.6 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6.
Jun 3, 2024Ninja Tables: Server-Side Request Forgery (SSRF)CVE-2024-35635 · affects up to 5.0.9 · reported by PatchstackMedium 4.4
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.CVE-2022-47136 · affects up to 4.3.4 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
May 10, 2023Auth.CVE-2022-47137 · affects up to 4.3.4 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <= 4.3.4 versions.
Feb 1, 2022Ninja Tables: Does not sanitise and escape some of its table fieldsCVE-2021-24900 · fixed in 4.1.8 · reported by WPScanMedium 4.8
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.