EUVD-2026-72092
GHSA-pgg5-mm47-8vxf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects impact contingent on registered shortcodes; PR:N confirmed unauthenticated; C:L/I:L match shortcode execution scope; A:N as no availability mechanism exists.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
AnalysisAI
Shortcode injection in the Ninja Forms WordPress plugin (versions 3.14.10 through 3.15.1) allows unauthenticated network attackers to execute any shortcode registered on the target site by embedding shortcode syntax into form request fields the plugin later processes. The plugin fails to strip or escape shortcode markers before passing user-controlled values through WordPress's shortcode execution pipeline, meaning the server interprets and runs injected tags. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Ninja Forms plugin active in versions 3.14.10 through 3.15.1, and at least one publicly accessible form that accepts and processes user input. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N yields a base score of 4.8 (Medium). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ninja Forms plugin to version 3.15.2 or later, which is the vendor-released patch per the CVE description's stated fix boundary. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ninja Forms
View allThe Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it ha
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. Rated high severity (CVSS 8.6), this vulnerab
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could le
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which coul
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions funct
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it bac
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes
Share
External POC / Exploit Code
Leaving vuln.today