{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/ninja-forms-plugin-3.10.4-3.14.9/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-65048"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ninja Forms plugin 3.10.4-3.14.9"],"_cs_severities":["critical"],"_cs_tags":["wordpress","xss","plugin","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Ninja Forms","WordPress"],"content_html":"\u003cp\u003eA critical unauthenticated stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-65048, affects the Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9. This flaw lies within the plugin's Repeatable Fieldset feature, specifically in the \u003ccode\u003eparseSubmissionIndex()\u003c/code\u003e function which fails to validate numeric input, allowing arbitrary strings as submission indexes. Subsequently, the \u003ccode\u003eadmin_form_element()\u003c/code\u003e function directly interpolates these unescaped, attacker-controlled strings into HTML when administrators view form submissions. An unauthenticated attacker can exploit this by submitting a public Ninja Forms form with a specially crafted repeater child key containing malicious JavaScript. When a site administrator accesses the WordPress admin panel to review the compromised form submission, the embedded script executes in their browser. This allows the attacker to achieve severe outcomes such as stealing session cookies, creating new administrative accounts, installing malicious plugins, or arbitrarily altering website content, posing a significant risk to the integrity and security of affected WordPress installations.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a WordPress site running the vulnerable Ninja Forms plugin (versions 3.10.4-3.14.9).\u003c/li\u003e\n\u003cli\u003eThe attacker accesses a public-facing Ninja Forms form that utilizes a Repeatable Fieldset feature.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP POST request to submit the form, embedding a malicious JavaScript payload within a repeater child key field as an arbitrary string.\u003c/li\u003e\n\u003cli\u003eThe server-side \u003ccode\u003eparseSubmissionIndex()\u003c/code\u003e function in the Ninja Forms plugin processes this submission, accepting the unvalidated, arbitrary string as a submission index without proper numeric validation.\u003c/li\u003e\n\u003cli\u003eWhen an administrator navigates to the WordPress admin panel to view the submitted form data, the \u003ccode\u003eadmin_form_element()\u003c/code\u003e function retrieves and interpolates the unescaped, malicious string directly into the HTML of the submission view.\u003c/li\u003e\n\u003cli\u003eThe administrator's web browser renders the HTML, executing the embedded malicious JavaScript payload.\u003c/li\u003e\n\u003cli\u003eThe executed script can steal the administrator's session cookies, create new administrator accounts, install malicious plugins, or arbitrarily modify the website's content.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-65048 by an unauthenticated attacker leads to significant security compromises. The primary impact includes session-cookie theft, which can grant an attacker unauthorized access to the administrator's active session, effectively bypassing authentication. Furthermore, the attacker can leverage the XSS to create new administrator accounts, granting persistent backdoor access, install malicious plugins to inject malware or backdoors, or arbitrarily modify existing website content, leading to defacement, data manipulation, or further compromise of site visitors. This high-severity vulnerability poses a critical risk to the confidentiality, integrity, and availability of affected WordPress installations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-65048 immediately by updating the Ninja Forms plugin to a version greater than 3.14.9.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detects CVE-2026-65048 Exploitation - Ninja Forms XSS Injection\u0026quot; to your SIEM and monitor webserver logs for suspicious form submissions containing XSS payloads.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging, ensuring that HTTP request bodies (\u003ccode\u003ec-bytes\u003c/code\u003e) are captured, as the malicious payload may reside within form submission data.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T15:19:42Z","date_published":"2026-07-21T15:19:42Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ninja-forms-xss/","summary":"A critical unauthenticated stored cross-site scripting (XSS) vulnerability (CVE-2026-65048) in the Ninja Forms plugin for WordPress allows attackers to inject malicious script payloads via crafted form submissions, leading to session-cookie theft, administrator account creation, and arbitrary content modification when an administrator views the submission.","title":"Critical Unauthenticated Stored XSS in Ninja Forms WordPress Plugin (CVE-2026-65048)","url":"https://feed.craftedsignal.io/briefs/2026-07-ninja-forms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Ninja Forms Plugin 3.10.4-3.14.9","version":"https://jsonfeed.org/version/1.1"}