Which versions of Ninja Forms are affected by CVE-2026-65048?

Ninja Forms WordPress plugin versions 3.10.4-3.14.9 contain a critical stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into form…. A patch is available.

How to fix or mitigate CVE-2026-65048?

Within 24 hours, identify all WordPress installations using Ninja Forms versions 3.10.4-3.14.9 and immediately apply the vendor patch to non-production systems; simultaneously review form submission logs and administrator access logs for evidence of XSS injection attempts. Within 7 days, complete patch deployment to all production WordPress installations running affected Ninja Forms versions, prioritizing sites with internet-exposed administrator interfaces. Within 30 days, audit all form submissions received during the vulnerability window for injected script payloads, review detailed administrator account activity logs for unauthorized plugin installations or configuration changes, and verify plugin file integrity across all systems.

Ninja Forms CVE-2026-65048

Q: What is the CVSS score of CVE-2026-65048?

CVE-2026-65048 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46267 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 VulnCheck

GHSA-895j-583x-29ww

WordPress XSS Ninja Forms Wordpress Plugin Saturday Drive

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated network submission (PR:N/AV:N/AC:L), payload requires an admin to view submissions (UI:R), and execution in the privileged admin context crosses a trust boundary (S:C) enabling account takeover (C:H/I:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 15:02 vuln.today

CVE Published

Jul 21, 2026 - 14:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Articles & Coverage 2

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 22, 2026 News Critical Stored XSS in WordPress Ninja Forms Plugin 3.10.4-3.14.9 - CVE-2026-65048 Jul 21, 2026

AnalysisAI

Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).

Technical ContextAI

The affected component is Saturday Drive's Ninja Forms, a widely deployed drag-and-drop form builder for WordPress (CPE cpe:2.3:a:saturday_drive:ninja_forms). The root cause is CWE-79 (improper neutralization of input during web page generation). Two functions collaborate to create the flaw: parseSubmissionIndex() accepts arbitrary strings as the submission index for a repeater child rather than enforcing numeric-only values, and admin_form_element() then interpolates that attacker-controlled index directly into the admin-side HTML markup without output escaping. The Repeatable Fieldset feature is the specific attack surface - its child-key handling is what carries the tainted value from an unauthenticated public form submission into the trusted admin rendering path.

RemediationAI

Patch available per vendor advisory: upgrade Ninja Forms to the current fixed release published by Saturday Drive - the exact patched version is not stated in the provided data, so consult the plugin changelog at https://wordpress.org/plugins/ninja-forms/changelog/ and the VulnCheck advisory (https://www.vulncheck.com/advisories/ninja-forms-unauthenticated-stored-cross-site-scripting-via-repeatable-fieldset-submission-index) to confirm the target version, then update from the WordPress plugin screen. If immediate patching is not possible, temporarily remove or disable any public-facing forms that use the Repeatable Fieldset feature, since that is the specific attack surface; note this breaks legitimate repeater submissions. As a defense-in-depth measure, add a WAF rule to block form submissions whose repeater child keys contain non-numeric or script-like content (e.g. angle brackets or 'on*' event handlers), accepting that WAF rules can be bypassed and may cause false positives, and have administrators avoid opening untrusted submissions until the update is applied.