Cpe:2.3:a:kevin_stover:ninja_forms:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3akevin_stoverninja_forms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 08:42:23 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgKevin Stover Ninja Forms: Stored Cross-site Scripting (CVE-2026-110899)https://feed.craftedsignal.io/briefs/2026-10-21-ninja-forms-xss/Wed, 21 Oct 2026 08:42:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-21-ninja-forms-xss/A stored cross-site scripting (XSS) vulnerability exists in the Kevin Stover Ninja Forms plugin due to improper neutralization of input during web page generation.CVE-2026-110899 is a stored cross-site scripting (XSS) vulnerability in the Kevin Stover Ninja Forms plugin. The vulnerability is caused by improper neutralization of input during web page generation. This issue affects Ninja Forms versions up to and including 3.15.5.

Impact

Successful exploitation allows for stored XSS.

]]>highadvisory