high
advisory
Kevin Stover Ninja Forms: Stored Cross-site Scripting (CVE-2026-110899)
A stored cross-site scripting (XSS) vulnerability exists in the Kevin Stover Ninja Forms plugin due to improper neutralization of input during web page generation.
CVE search metadata
CVE search record: CVE-2026-110899. Severity: high. CVSS: 7.1. KEV: no. Product: Ninja Forms (n/a through 3.15.5). Brief: Kevin Stover Ninja Forms: Stored Cross-site Scripting (CVE-2026-110899). Brief link: https://feed.craftedsignal.io/briefs/2026-10-21-ninja-forms-xss/
Triage facts
Revision 1- Applicability
- Ninja Forms (n/a through 3.15.5)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 21, 08:42 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-110899 is a stored cross-site scripting (XSS) vulnerability in the Kevin Stover Ninja Forms plugin. The vulnerability is caused by improper neutralization of input during web page generation. This issue affects Ninja Forms versions up to and including 3.15.5.
Impact
Successful exploitation allows for stored XSS.