EUVD-2026-114576
GHSA-6x82-24xh-w634
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted nf_ajax_submit request
-
DeliveryObtain valid nonce returned on failure
-
ExploitInject script via formData.extra
-
ExecutionPayload stored unsanitized
-
PersistAdmin views injected page
-
ImpactScript executes in admin session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication or special configuration is required: the flaw is reachable in default installations because the nf_ajax_submit endpoint issues a valid nonce to any requester on failure, defeating the nonce check and allowing the 'formData.extra' value to be stored without sufficient sanitization or output escaping. The practical limiting factor is that this is stored XSS - the injected script does not run at injection time but only when a user (typically an administrator reviewing form submissions/calculations) later loads the page that renders the stored value; impact is scoped to actions executable in that victim's browser session. Applies to Ninja Forms versions up to and including 3.15.5. |
| Impact | Multiple signals point to a genuine, near-term priority rather than a paper-high CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) describes unauthenticated, network-reachable, low-complexity exploitation with a scope change, and the description reinforces this with a concrete mechanism: the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, so the nonce check is effectively neutralized and injection succeeds in a single unauthenticated request. The vuln.today decision label is 'this_week', consistent with a serious but not emergency finding. No EPSS score, no CISA KEV entry, and no working exploit were provided, so there is no evidence of active exploitation or mass scanning yet - the elevated concern rests on the ease of exploitation and the plugin's large install base, not on observed attacks. The impact is bounded to C:L/I:L (no availability impact), typical of stored XSS: script execution in a victim's browser session, most dangerously an authenticated administrator viewing the injected content. Net: treat as a real priority to patch promptly given trivial unauthenticated reachability, while recognizing exploitation-in-the-wild is not confirmed by the available data. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted nf_ajax_submit request with a malicious script in the 'formData.extra' parameter; because the endpoint returns a valid nonce on failure, the normal nonce protection does not stop the request and the payload is stored. When an administrator (or other user) later opens the page or submission view that renders this data, the script executes in their authenticated browser context. No public working exploit was identified in the provided data, though the vulnerability-research writeup is from Wordfence and plugin source lines are referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 31, 2026
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
RemediationAI
An upstream fix has been committed to the plugin trunk in changeset 3749135 (https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/includes/Templates/admin-metaboxes-calcs.html.php), covering the calculations metabox template that renders stored values - but a tagged, released patched version is not independently confirmed in the available data, so updating past 3.15.5 should be validated against the vendor advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/54da4deb-e50c-478d-ab99-222c5573a036?source=cve) before it is assumed to resolve both the storage and rendering halves of the flaw. Because the vulnerable path is an unauthenticated public submission endpoint combined with an administrative render sink, the most direct interim containment is to keep the plugin disabled on sites that cannot immediately validate a fixed build, accepting that all public forms stop working; a narrower alternative is to restrict access to the submissions and calculations administrative screens and to review existing stored submissions for injected markup, though neither closes the public injection point. Blocking or filtering POST requests to the nf_ajax_submit action, for example with a WAF rule that rejects unexpected 'formData.extra' content, reduces exposure but risks breaking legitimate form submissions and calculations until the rule is tuned. Given the this_week priority and the trivially reachable unauthenticated injection path, scheduling the update within the current patch cycle is appropriate; this is not an emergency-level, actively exploited condition based on the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin, so the attack surface is the plugin's public AJAX handler rather than the CMS core. The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant: a value supplied in the 'formData.extra' field of a form submission is persisted into the plugin's submission records and later emitted into an administrative page without correct encoding. The referenced source locations trace that path - the Submission AJAX controller (includes/AJAX/Controllers/Submission.php, including the nonce handling around line 52 and the submission logic around line 428), the Save action (includes/Actions/Save.php line 311) and the Submission database model (includes/Database/Models/Submission.php line 731) for ingestion and storage, and the calculations metabox template (includes/Templates/admin-metaboxes-calcs.html.php line 4, with includes/Admin/Metaboxes/Calculations.php line 23) as the rendering sink. The critical design weakness described is that nf_ajax_submit returns a valid nonce to any requester even when the request fails, so the standard WordPress nonce gate provides no protection and the attacker does not need an account, a session, or prior reconnaissance. The CVSS scope change (S:C) is consistent with script that runs in an administrator's authenticated browser context while originating from an unprivileged, unauthenticated request. The trigger is well described in the available sources up to the point of storage and render; the exact administrative screens a given victim must visit, and whether other non-calculation render paths are equally affected, are not enumerated in the provided data.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated single-request injection (PR:N/AC:L) due to the neutralized nonce; stored XSS executing in another security context yields S:C with limited C/I and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid nonce to any requester on failure, effectively neutralizing the nonce check and making exploitation trivially achievable in a single unauthenticated request.
Executive ViewAI
The Ninja Forms WordPress plugin, used by many organizations for contact forms and calculators, contains a stored cross-site scripting (XSS) vulnerability (CVE-2026-109997) that allows unauthenticated attackers to inject malicious scripts into form submissions. When an administrator views the affected submissions, the script executes, potentially compromising the administrator's session and enabling further unauthorized actions. This puts organizations at risk of data breaches and website defacement, and leadership should prioritize remediation because the plugin is widely deployed and exploitation requires no authentication.
Deploy WAF rules to block malicious payloads targeting the 'formData.extra' parameter or restrict access to the nf_ajax_submit endpoint to trusted IPs; disable the plugin if it cannot be adequately protected; enforce least privilege and monitor administrator sessions for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB