Ninja Forms – The Contact Form Builder That Grows With You (<= 3.15.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ninja-forms--the-contact-form-builder-that-grows-with-you--3.15.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 06:23:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in Ninja Forms WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss/Fri, 02 Oct 2026 06:23:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ninja-forms-xss/The Ninja Forms WordPress plugin versions 3.15.4 and earlier contain a stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject malicious scripts via Paragraph Text fields with Rich Text Editor enabled.The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping within its Paragraph Text field handling. This vulnerability, identified as CVE-2026-90438, affects all versions up to and including 3.15.4. Unauthenticated attackers can exploit this by submitting specially crafted malicious scripts through forms where the Paragraph Text field has the Rich Text Editor (RTE) option enabled. Once submitted, the malicious payload is stored by the application and executes in the browser context of any user, such as an administrator, who views the submitted form data in the WordPress dashboard. This allows for session hijacking, credential theft, or unauthorized administrative actions.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of the WordPress administrative session. This can lead to full site compromise, unauthorized configuration changes, or the injection of further malicious content, directly impacting the security posture of any WordPress site utilizing the affected versions of the plugin.

Recommendation

Update the Ninja Forms - The Contact Form Builder That Grows With You plugin to the latest version immediately to remediate CVE-2026-90438. Prioritize identifying and auditing any forms currently using the Paragraph Text field with the Rich Text Editor (RTE) option enabled to check for potential existing payloads.

]]>highadvisoryweb-vulnerabilitywordpressxsscve-2026-90438