Read the docs
TI-2021-07180 Aliases CVE-2021-24900GHSA-j2rw-94m6-fg6j

Ninja Tables < 4.1.8 - Admin+ Stored Cross-Site Cross-Site Scripting

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Why it matters now

EPSS 0.00686 52nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Ninja Tables – Best WP DataTables Plugin for WordPress (Unknown): 4.1.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownNinja Tables – Best WP DataTables Plugin for WordPress4.1.8 to before 4.1.84.1.8Patch availableCNA
  • Ninja Tables – Best WP DataTables Plugin for WordPress VendorUnknown Affected 4.1.8 to before 4.1.8 Fixed in 4.1.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:wordpress:*:*before 4.1.8VulnerableWP ManageNinja LLC
  • cpe:2.3:a:wpmanageninja:ninja_tables:*:*:*:*:*:wordpress:*:* Versions before 4.1.8 Vulnerable ·WP ManageNinja LLC

Remediation

  • Fix · CNA Ninja Tables – Best WP DataTables Plugin for WordPress (Unknown) Fixed in 4.1.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24900
  2. 2026-10-03 Alias added: GHSA-j2rw-94m6-fg6j

References

Exploit 2

  • TI-2024-11836 Ninja Tables < 5.0.17 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
  • TI-2025-02568 Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery CVSS 3.1HIGH 7.2
  • TI-2022-23341 WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2024-15546 WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.3
  • TI-2024-06765 Cross-site scripting in techjewel Ninja Tables – Easy Data Table Builder CVSS 3.1MEDIUM 6.4
  • TI-2022-23342 WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 5.9
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences