EUVD-2026-70564
GHSA-vhxc-28cc-c8wv
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Ninja Forms File Uploads Extension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
Executive ViewAI
WordPress sites using Ninja Forms File Uploads Extension (versions 3.3.26 and earlier) are vulnerable to attackers who can inject malicious scripts capturing administrator sessions and user credentials. This unauthenticated vulnerability poses an immediate risk to site integrity and user data, with no vendor patch currently available.
Within 24 hours, inventory all WordPress sites running Ninja Forms File Uploads Extension version 3.3.26 or earlier and disable the plugin immediately; no public exploit identified at time of analysis, though technical details are documented. Within 7 days, implement Web Application Firewall rules blocking suspicious file uploads to affected endpoints, deploy Content Security Policy headers to prevent inline script execution, and restrict upload functionality to authenticated users only. Within 30 days, monitor vendor advisories for security patches; if none are released, evaluate migration to alternative, actively-maintained file upload solutions.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable Ninja Forms File Uploads Extension immediately, implement Web Application Firewall rules to block malicious file uploads, deploy strict Content Security Policy (CSP) headers restricting inline script execution, restrict file upload functionality to authenticated users only, and enable enhanced logging and alerting on upload endpoints to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB