Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*

2 briefs RSS
high advisory

Stored XSS in Ninja Forms WordPress Plugin

The Ninja Forms WordPress plugin versions 3.15.4 and earlier contain a stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject malicious scripts via Paragraph Text fields with Rich Text Editor enabled.

Ninja Forms – The Contact Form Builder That Grows With You web-vulnerability wordpress xss cve-2026-90438
2t 1c
high advisory

Stored XSS and Arbitrary File Write in Ninja Forms WordPress Plugin

An unauthenticated stored XSS and arbitrary file write vulnerability in Ninja Forms versions 3.15.1 and earlier allows attackers to inject malicious scripts by exploiting input validation flaws in the File Uploads add-on.

Ninja Forms web-application wordpress xss cve-2026-19769
2t 1c