Is CVE-2026-87870 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87870 being exploited in the wild.

How severe is CVE-2026-87870?

Medium severity, with a CVSS score of 6.4, published 10 September 2026.

Which products and versions are affected?

Ninja Forms Scheduled Exports up to and including 3.0.3.

Is there a fix for CVE-2026-87870?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-87870 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87870?

Check whether you run Ninja Forms Scheduled Exports at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87870: Ninja Forms Scheduled Exports stored XSS via REST API

CVE-2026-87870 · Severity: medium · CVSS 6.4 · Published 2026-09-10

The Ninja Forms Scheduled Exports plugin automates the delivery of form submission data via email on a scheduled basis. A stored cross-site scripting vulnerability allows authenticated users with subscriber-level access to inject malicious scripts into the plugin's configuration, which then execute when administrators or other users access the affected pages, potentially leading to account compromise or unauthorized actions.

Vendors: Ninja Forms.

Quick answers

Is CVE-2026-87870 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87870 being exploited in the wild.
How severe is CVE-2026-87870?: Medium severity, with a CVSS score of 6.4, published 10 September 2026.
Which products and versions are affected?: Ninja Forms Scheduled Exports up to and including 3.0.3.
Is there a fix for CVE-2026-87870?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87870 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87870?: Check whether you run Ninja Forms Scheduled Exports at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the plugin's REST API endpoints that handle scheduled export parameters (interval, format, emailTo) in versions up to 3.0.3. The REST endpoint lacks proper input sanitization and output escaping, and is registered without a permission_callback—only validating a nonce without checking user capabilities. This allows authenticated attackers with subscriber-level privileges and above to inject arbitrary JavaScript code that persists in the database and executes in the browsers of users viewing the affected pages. The vulnerability requires user authentication but not administrative privileges.

Affected products

Ninja Forms Scheduled Exports up to and including 3.0.3

Timeline

2026-09-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.