EUVD-2026-89941
GHSA-45xc-76g4-jjx3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload in URL/input
-
DeliveryLure victim to click crafted link
-
ExploitPayload reflected unsanitized by Ninja Forms
-
ExecutionScript executes in victim browser session
-
ImpactSteal session tokens or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a WordPress site running the Ninja Forms plugin at version 3.15.3 or earlier, and - per UI:R in the CVSS vector - requires the attacker to induce a victim to interact (e.g., click a crafted link or load a malicious page) so the unsanitized payload is rendered in their browser. No authentication is needed (PR:N), and the vector is remote (AV:N) with low complexity (AC:L). The primary limiting factors are the mandatory user interaction and the fact that impact is confined to the victim's browser session (C:L/I:L/A:L) rather than direct server compromise; the exact vulnerable parameter/endpoint is not specified in available data, which constrains precise targeting. |
| Impact | The CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) reflects a network-reachable, unauthenticated XSS with low complexity but requiring user interaction (UI:R) and delivering only low-impact effects across a changed scope (browser context rather than server). No EPSS score, CISA KEV listing, or public POC is present in the supplied data - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no SSVC decision data provided. Contrasting the signals: the headline 7.1 is driven largely by the scope-change (S:C) and unauthenticated vector, but the real-world severity is tempered by mandatory victim interaction and the low, browser-bound C/I/A impacts - this is a genuine but moderate-priority web vulnerability rather than a wormable critical flaw. The Patchstack description does not name the specific parameter, sink, or whether the XSS is reflected or stored, so the exact delivery path cannot be confirmed from available data; UI:R strongly implies a reflected/social-engineered variant. |
| Exploit ScenarioDerived | An attacker crafts a URL or form input containing malicious JavaScript targeting a vulnerable Ninja Forms endpoint on a WordPress site running <= 3.15.3 and lures a victim into clicking it. When the victim's browser renders the unsanitized payload, the script executes in the site's origin, enabling session/cookie theft or actions in the victim's authenticated context. No POC is available in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
RemediationAI
The affected range is stated as Ninja Forms 3.15.3 and earlier, which implies a correction exists in a later release, but no exact patched version number or patch reference is present in the supplied data, so the status is: no vendor-released fix version identified at time of analysis. Begin by upgrading the plugin to the newest version available from the WordPress plugin repository or the vendor, confirming the installed version after the update, and verifying via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ninja-forms/vulnerability/wordpress-ninja-forms-plugin-3-15-3-cross-site-scripting-xss-vulnerability-2?_s_id=cve) whether a fixed release has since been published. If an update cannot be applied immediately, compensating controls include deactivating the Ninja Forms plugin entirely - effective but it removes all forms functionality from the site - or restricting plugin usage/exposure so that untrusted users cannot reach pages where form or plugin data is rendered. Because this is reflected/rendered XSS requiring user interaction, a web application firewall or ModSecurity rule set with XSS signatures can block common payload patterns, though encodings and DOM-based variants can bypass signature matching and false positives may break legitimate form submissions. A strict Content-Security-Policy that disallows inline and third-party scripts reduces execution of injected code but can break themes, page builders, and analytics scripts and requires careful testing. Keep WordPress core and all other plugins current, and review server and browser-side logs for suspicious script parameters as an interim detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected software is the Ninja Forms plugin for WordPress, tracked via CPE cpe:2.3:a:kevin_stover:ninja_forms:*:*:*:*:*:*:*:* (vendor listed as kevin_stover, the plugin's originating author). Root cause is CWE-79, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): plugin-supplied input reaches a page or response without adequate output encoding or sanitization, so attacker-controlled markup is executed in the browser of the visiting user. WordPress plugins execute as PHP on the web server, and the CVSS scope change (S:C) accurately reflects that the vulnerable server-side component affects a different security authority - the victim's browser - rather than the server itself, which is why confidentiality, integrity, and availability impacts are each rated Low. The unauthenticated rating follows directly from PR:N in the assessed vector, meaning the injected content is reachable without a valid account; UI:R indicates the payload is not self-executing and depends on victim interaction such as following a link or loading a page. Because the advisory does not identify the specific parameter, hook, or form field involved, defenders cannot target a single endpoint and must rely on the fixed version or generic XSS filtering.
Know when Ninja Forms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network XSS (PR:N/AV:N) needing victim interaction (UI:R); script executes cross-context (S:C) with limited browser-scoped C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Executive ViewAI
Organizations operating WordPress sites with Ninja Forms 3.15.3 or earlier face an unauthenticated cross-site scripting exposure that can execute attacker-supplied script in a victim's browser when a user is induced to click a crafted link. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis, but successful exploitation could affect administrative or visitor sessions and damage trust in public-facing sites. Leadership should prioritize inventory and interim mitigations for any internet-facing WordPress property using the affected plugin.
No vendor-released patch identified at time of analysis. Interim mitigations include WAF/virtual patching for XSS against Ninja Forms, restricting administrator access and sessions, enforcing Content Security Policy, disabling or removing the plugin if not required, monitoring for suspicious admin activity, and user awareness against clicking untrusted links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Ninja Forms
View allThe Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
Stored cross-site scripting in the Ninja Forms WordPress plugin 3.15.3 lets an unauthenticated visitor plant a script pa
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Rated high severity (CVSS 8.6), this vulnerab
PHP Object Injection in the Ninja Forms WordPress plugin 3.15.3 allows unauthenticated attackers to plant serialized pay
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it bac
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable
Exploit-DB