Skip to content
Threat Feed
Subscribe
high advisory

Ninja Forms: Stored Cross-Site Scripting via formData.extra (CVE-2026-109997)

The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.

CVE search metadata

CVE search record: CVE-2026-109997. Severity: high. CVSS: 7.2. KEV: no. Product: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (<= 3.15.5). Brief: Ninja Forms: Stored Cross-Site Scripting via formData.extra (CVE-2026-109997). Brief link: https://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss-59c0fda1/

Triage facts

Revision 1
Applicability
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (<= 3.15.5)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 31, 07:51 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder for WordPress (all versions up to and including 3.15.5) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the 'formData.extra' parameter. An unauthenticated attacker can exploit this via the 'nf_ajax_submit' endpoint. Due to improper nonce handling, the endpoint issues a valid nonce on request failure, effectively bypassing security protections.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of any user (including administrators) who accesses the injected page, potentially leading to unauthorized actions or credential theft.

Recommendation

  • Upgrade the Ninja Forms plugin to the latest version beyond 3.15.5 immediately.
  • Review WordPress access logs for anomalous requests to the 'nf_ajax_submit' endpoint containing suspicious 'formData.extra' parameter content.
  • Inspect plugin configuration and form submission entries for injected JavaScript payloads.

Immediate actions

Upgrade Ninja Forms plugin to the latest version

IT Operations 24h

Threat Hunt

Hunt for anomalous scripts stored in the database

T1059.007 high medium confidence hunt now

Data: Database table entries for Ninja Forms

Mitigations

Update Ninja Forms

immediate IT Operations

CVE-2026-109997

Detection coverage 1

Detects CVE-2026-109997 Exploitation - Stored XSS in Ninja Forms

high

Detects potential exploitation of CVE-2026-109997 via HTTP POST requests to the nf_ajax_submit endpoint containing XSS payloads in the formData.extra parameter.

sigma tactics: execution, initial_access techniques: T1059.007, T1190 sources: webserver

Detection queries are available on the platform. Get full rules →