Ninja Forms CVE-2026-110899

Exploitation requires that the attacker's script payload be persisted by Ninja Forms (stored XSS) and that a privileged user - typically a WordPress administrator - subsequently views the stored content in a context where the plugin renders it without proper output neutralization; this victim interaction (UI:R) is the key limiting factor. The description does not name a specific non-default configuration or feature toggle, so it appears to affect standard Ninja Forms deployments on versions up to 3.15.5, but the exact vulnerable field/submission view is not specified in the available data. The dependency on an administrator opening the malicious entry, rather than automatic firing, meaningfully constrains real-world reliability.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Ninja Forms WordPress plugin, affecting versions up to and including 3.15.5. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1 High) indicates a network-reachable, low-complexity issue requiring no attacker privileges but requiring victim user interaction, with a scope change and limited confidentiality, integrity and availability impact - the classic profile of stored XSS where unauthenticated input is persisted and later rendered in a privileged context (e.g., an admin viewing submissions). Exploitation status: no public exploit identified at time of analysis - the only source is a Patchstack database/advisory entry, with no CISA KEV listing, no POC flag, and no EPSS score provided, so there is no evidence of active exploitation and the real-world urgency is moderate rather than critical. The PR:N/UI:R combination is self-consistent with an unauthenticated attacker planting a payload that fires when a logged-in administrator reviews the stored data. No EPSS or KEV data was provided to corroborate or contradict the CVSS; absent those signals, prioritize this as a standard 'patch on next maintenance cycle' item for affected sites, elevated only by the plugin's large install base and the fact that form plugins routinely accept untrusted public input.

An unauthenticated attacker submits a Ninja Forms form (or otherwise supplies form-related input) containing a malicious script payload that is stored by the plugin. When a WordPress administrator later views the submitted data in the wp-admin dashboard, the script executes in their authenticated browser session, enabling session/cookie theft, admin actions on their behalf, or injection of further web content. No public exploit code has been identified, but the low attack complexity and lack of required privileges make weaponization straightforward.