{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/kevin-stover/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kevin_stover:ninja_forms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-110899"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ninja Forms (n/a through 3.15.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Kevin Stover"],"content_html":"\u003cp\u003eCVE-2026-110899 is a stored cross-site scripting (XSS) vulnerability in the Kevin Stover Ninja Forms plugin. The vulnerability is caused by improper neutralization of input during web page generation. This issue affects Ninja Forms versions up to and including 3.15.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for stored XSS.\u003c/p\u003e\n","date_modified":"2026-10-21T08:42:23Z","date_published":"2026-10-21T08:42:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-21-ninja-forms-xss/","summary":"A stored cross-site scripting (XSS) vulnerability exists in the Kevin Stover Ninja Forms plugin due to improper neutralization of input during web page generation.","title":"Kevin Stover Ninja Forms: Stored Cross-site Scripting (CVE-2026-110899)","url":"https://feed.craftedsignal.io/briefs/2026-10-21-ninja-forms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Kevin Stover","version":"https://jsonfeed.org/version/1.1"}