Ninja Forms EUVD-2026-114704

Exploitation requires that the target page renders a Ninja Forms form that uses the {field:*} merge-tag placeholder, and that the attacker supply a matching 'querystring:<key>' / 'field:<key>' URL parameter so the server fully resolves the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and rebuild the field content from the raw query string. The decisive limiting factor is required user interaction (UI:R): a victim must be socially engineered into clicking the crafted link - there is no server-side-only, no-interaction path. Exploitation is unauthenticated (PR:N) and affects Ninja Forms versions up to and including 3.15.5. This dependence on a specific merge-tag-using form page plus mandatory victim interaction makes the realistic risk targeted rather than widespread, despite the network attack vector.

This is a medium-severity reflected DOM-based XSS (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) in the Ninja Forms WordPress plugin. The signals are internally consistent and point to a real-but-not-emergency issue: the attack vector is network (AV:N) and unauthenticated (PR:N), but exploitation is gated by required user interaction (UI:R) - a victim must be tricked into clicking an attacker-crafted link - which sharply limits opportunistic, automatable mass exploitation and is the main reason the base score sits at medium rather than high. The vuln.today priority is 'this_month', not 'act_now' or 'emergency', aligning with the medium severity. There is no CISA KEV listing and no EPSS score was supplied in the input, so there is no evidence of active exploitation or a quantified exploitation probability; absence of these is not itself a contradiction but means the urgency rests on severity and the vendor (Wordfence) advisory rather than on observed attacks. No confirmed working exploit code was provided - the references are a vendor writeup and source/changeset links, not a PoC. Net: a legitimate issue to patch on a normal monthly cadence given the plugin's large install base, but the UI:R requirement makes it a targeted/social-engineering risk rather than a wormable, drive-by threat.

An unauthenticated attacker crafts a URL for a page hosting a Ninja Forms form that uses {field:*} merge-tag placeholders, appending a malicious 'querystring:<key>' / 'field:<key>' parameter whose value contains script. The attacker sends this link to a victim (e.g., via email or a malicious post); when the victim clicks it, the client-side else-branch reconstructs the field content from the raw query string instead of the server-sanitized value, executing the injected script in the victim's browser. No public working exploit code was identified at time of analysis.