Executive brief
Ninja Forms is a WordPress plugin that allows website owners to create and manage contact and submission forms. The plugin fails to properly escape user-submitted form data before displaying it to administrators reviewing submissions, allowing attackers to inject malicious scripts that execute in the browsers of site administrators and other privileged users who view the submissions, potentially compromising administrative accounts.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the submission edit screen where form field values are output without proper escaping. An unauthenticated attacker can submit arbitrary HTML/JavaScript through a public form, which then executes in the browser of high-privileged users (administrators) when they review the submission in the WordPress admin area. The vulnerability affects version 3.15.3 and was patched in 3.15.4.
Affected products
- Ninja Forms Ninja Forms 3.15.3
Timeline
- 2026-09-22: disclosed: Publicly published
- 2026-09-22: patched: Fixed in version 3.15.4