Cpe:2.3:a:ninja_forms:ninja_forms:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aninja_formsninja_formswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 22 Sep 2026 08:34:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored Cross-Site Scripting in Ninja Forms Pluginhttps://feed.craftedsignal.io/briefs/2026-09-ninja-forms-xss/Tue, 22 Sep 2026 08:34:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-ninja-forms-xss/CVE-2026-94504 describes a stored cross-site scripting vulnerability in Ninja Forms version 3.15.3, allowing attackers to execute arbitrary scripts in an administrator's browser session via the legacy submission editor.CVE-2026-94504 is a security vulnerability in the Ninja Forms plugin (version 3.15.3) that stems from improper input sanitization of anonymous non-RTE (Rich Text Editor) textarea fields. The plugin stores user-provided input in these fields and fails to perform adequate HTML encoding when rendering the data within the legacy submission editor interface. An attacker can supply malicious JavaScript payloads within these textarea inputs. When a site administrator accesses the specific direct submission URL associated with the malicious entry, the injected script executes within the context of the WordPress admin origin. This flaw allows attackers to perform unauthorized actions or gain access to sensitive information by leveraging the trust associated with the administrator's authenticated session.

Impact

Successful exploitation results in Stored Cross-Site Scripting (XSS), which can lead to session hijacking, unauthorized administrative actions, or the unauthorized modification of site content. This vulnerability specifically impacts WordPress environments where Ninja Forms 3.15.3 is installed and utilizes the legacy submission editor.

Recommendation

  1. Upgrade the Ninja Forms plugin to a patched version beyond 3.15.3 immediately.
  2. Implement a strong Content Security Policy (CSP) to mitigate the execution of unauthorized scripts in the WordPress admin dashboard.
  3. Audit existing submission entries for suspicious script tags or obfuscated JavaScript payloads.
]]>highadvisoryxssweb-vulnerabilitywordpress