Ninja Forms – Contact Form Builder With Calculators, Quizzes, Signatures & AI Form Builder (<= 3.15.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ninja-forms--contact-form-builder-with-calculators-quizzes-signatures--ai-form-builder--3.15.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:51:28 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNinja Forms: Stored Cross-Site Scripting via formData.extra (CVE-2026-109997)https://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss-59c0fda1/Sat, 31 Oct 2026 07:51:28 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss-59c0fda1/The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder for WordPress (all versions up to and including 3.15.5) contains a stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the 'formData.extra' parameter. An unauthenticated attacker can exploit this via the 'nf_ajax_submit' endpoint. Due to improper nonce handling, the endpoint issues a valid nonce on request failure, effectively bypassing security protections.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of any user (including administrators) who accesses the injected page, potentially leading to unauthorized actions or credential theft.

Recommendation

  • Upgrade the Ninja Forms plugin to the latest version beyond 3.15.5 immediately.
  • Review WordPress access logs for anomalous requests to the 'nf_ajax_submit' endpoint containing suspicious 'formData.extra' parameter content.
  • Inspect plugin configuration and form submission entries for injected JavaScript payloads.
]]>highadvisoryxssweb-applicationwordpressplugin-vulnerability