What is the CVSS score of CVE-2026-81773?

CVE-2026-81773 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Wordpress Plugin are affected by CVE-2026-81773?

WordPress sites using Ninja Forms File Uploads Extension (versions 3.3.26 and earlier) are vulnerable to attackers who can inject malicious scripts capturing administrator sessions and user…

How to fix or mitigate CVE-2026-81773?

Within 24 hours, inventory all WordPress sites running Ninja Forms File Uploads Extension version 3.3.26 or earlier and disable the plugin immediately; no public exploit identified at time of analysis, though technical details are documented. Within 7 days, implement Web Application Firewall rules blocking suspicious file uploads to affected endpoints, deploy Content Security Policy headers to prevent inline script execution, and restrict upload functionality to authenticated users only. Within 30 days, monitor vendor advisories for security patches; if none are released, evaluate migration to alternative, actively-maintained file upload solutions.

Wordpress Plugin CVE-2026-81773

EUVD-2026-70564 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-09-03 Patchstack

GHSA-vhxc-28cc-c8wv

WordPress XSS Wordpress Plugin Ninja Forms File Uploads Extension Saturday Drive

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 03, 2026 - 17:03 vuln.today

CVE Published

Sep 03, 2026 - 16:31 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

AnalysisAI

Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all WordPress sites running Ninja Forms File Uploads Extension version 3.3.26 or earlier and disable the plugin immediately; no public exploit identified at time of analysis, though technical details are documented. …

Threat intelligence, references, and detailed analysis are available after sign-in.