{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ninja-forms--contact-form-builder-with-calculators-quizzes-signatures--ai-form-builder--3.15.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ninja_forms:contact_form_builder_with_calculators_quizzes_signatures_ai_form_builder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109997"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures \u0026 AI Form Builder (\u003c= 3.15.5)"],"_cs_severities":["high"],"_cs_tags":["xss","web-application","wordpress","plugin-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Ninja Forms"],"content_html":"\u003cp\u003eNinja Forms - Contact Form Builder with Calculators, Quizzes, Signatures \u0026amp; AI Form Builder for WordPress (all versions up to and including 3.15.5) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the 'formData.extra' parameter. An unauthenticated attacker can exploit this via the 'nf_ajax_submit' endpoint. Due to improper nonce handling, the endpoint issues a valid nonce on request failure, effectively bypassing security protections.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of any user (including administrators) who accesses the injected page, potentially leading to unauthorized actions or credential theft.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Ninja Forms plugin to the latest version beyond 3.15.5 immediately.\u003c/li\u003e\n\u003cli\u003eReview WordPress access logs for anomalous requests to the 'nf_ajax_submit' endpoint containing suspicious 'formData.extra' parameter content.\u003c/li\u003e\n\u003cli\u003eInspect plugin configuration and form submission entries for injected JavaScript payloads.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:51:28Z","date_published":"2026-10-31T07:51:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss-59c0fda1/","summary":"The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.","title":"Ninja Forms: Stored Cross-Site Scripting via formData.extra (CVE-2026-109997)","url":"https://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss-59c0fda1/"}],"language":"en","title":"CraftedSignal Threat Feed - Ninja Forms – Contact Form Builder With Calculators, Quizzes, Signatures \u0026 AI Form Builder (\u003c= 3.15.5)","version":"https://jsonfeed.org/version/1.1"}