Critical Unauthenticated Stored XSS in Ninja Forms WordPress Plugin (CVE-2026-65048)

A critical unauthenticated stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-65048, affects the Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9. This flaw lies within the plugin's Repeatable Fieldset feature, specifically in the parseSubmissionIndex() function which fails to validate numeric input, allowing arbitrary strings as submission indexes. Subsequently, the admin_form_element() function directly interpolates these unescaped, attacker-controlled strings into HTML when administrators view form submissions. An unauthenticated attacker can exploit this by submitting a public Ninja Forms form with a specially crafted repeater child key containing malicious JavaScript. When a site administrator accesses the WordPress admin panel to review the compromised form submission, the embedded script executes in their browser. This allows the attacker to achieve severe outcomes such as stealing session cookies, creating new administrative accounts, installing malicious plugins, or arbitrarily altering website content, posing a significant risk to the integrity and security of affected WordPress installations.

Attack Chain

1. An unauthenticated attacker identifies a WordPress site running the vulnerable Ninja Forms plugin (versions 3.10.4-3.14.9).
2. The attacker accesses a public-facing Ninja Forms form that utilizes a Repeatable Fieldset feature.
3. The attacker crafts an HTTP POST request to submit the form, embedding a malicious JavaScript payload within a repeater child key field as an arbitrary string.
4. The server-side parseSubmissionIndex() function in the Ninja Forms plugin processes this submission, accepting the unvalidated, arbitrary string as a submission index without proper numeric validation.
5. When an administrator navigates to the WordPress admin panel to view the submitted form data, the admin_form_element() function retrieves and interpolates the unescaped, malicious string directly into the HTML of the submission view.
6. The administrator's web browser renders the HTML, executing the embedded malicious JavaScript payload.
7. The executed script can steal the administrator's session cookies, create new administrator accounts, install malicious plugins, or arbitrarily modify the website's content.

Impact

Successful exploitation of CVE-2026-65048 by an unauthenticated attacker leads to significant security compromises. The primary impact includes session-cookie theft, which can grant an attacker unauthorized access to the administrator's active session, effectively bypassing authentication. Furthermore, the attacker can leverage the XSS to create new administrator accounts, granting persistent backdoor access, install malicious plugins to inject malware or backdoors, or arbitrarily modify existing website content, leading to defacement, data manipulation, or further compromise of site visitors. This high-severity vulnerability poses a critical risk to the confidentiality, integrity, and availability of affected WordPress installations.

Recommendation

• Patch CVE-2026-65048 immediately by updating the Ninja Forms plugin to a version greater than 3.14.9.
• Deploy the Sigma rule "Detects CVE-2026-65048 Exploitation - Ninja Forms XSS Injection" to your SIEM and monitor webserver logs for suspicious form submissions containing XSS payloads.
• Enable comprehensive web server logging, ensuring that HTTP request bodies (c-bytes) are captured, as the malicious payload may reside within form submission data.