Ninja Forms CVE-2026-95515

Exploitation requires an installation of the Ninja Forms WordPress plugin at version 3.15.3 or earlier. No authentication is needed (PR:N), but the attack is limited by required user interaction (UI:R): a victim must be tricked into loading the attacker-supplied reflected payload (e.g., clicking a crafted link), so it is not a fully automatable remote compromise. Impact is confined to script execution in the victim's browser within the site origin; there is no server-side code execution. Sites on patched/newer Ninja Forms versions are not affected.

This is a moderate-severity XSS in the Ninja Forms WordPress plugin (<=3.15.3), reported by Patchstack. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) indicates network-reachable, low-complexity, unauthenticated exploitation but critically gated on UI:R - a victim must be induced to trigger the malicious payload (consistent with a reflected/unauthenticated XSS rather than a self-propagating stored flaw). No EPSS score, no CISA KEV listing, and no public POC are provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The A:L (and to a lesser extent C:L/I:L) impact ratings are generous for a classic XSS: script execution in a victim's browser session realistically yields limited confidentiality/integrity impact (session/DOM access) but rarely availability impact, so a more defensible score is closer to ~6.1 with A:N. The S:C (scope change) is reasonable since injected script crosses from the vulnerable plugin into the browser security context. Net: a real but not urgent priority - patch in normal cadence. It is a mid-CVSS issue whose real-world risk is bounded by the required user interaction and the absence of any exploitation signal.

An unauthenticated attacker crafts a URL or form input containing malicious JavaScript that Ninja Forms reflects back unescaped, then lures a site visitor or administrator into loading it (phishing link, malicious page). When the victim's browser renders the response, the script executes in the site's origin, enabling session/cookie theft or actions in the victim's context. No public POC or exploit code is identified at time of analysis, and successful exploitation depends on the victim clicking (UI:R).