Ninja Forms EUVD-2026-46267

Exploitation requires a publicly accessible Ninja Forms form that uses the Repeatable Fieldset feature - that feature being present and reachable is the concrete precondition, since the vulnerable parseSubmissionIndex()/admin_form_element() path is specific to repeater child-key handling. The attacker needs no account (PR:N) and only submits the form with a malicious repeater child key as the submission index. The key limiting factor is UI:A: the payload lies dormant until an administrator actively opens the affected submission in the WordPress admin panel, so exploitation depends on that human action and on the site actually reviewing form entries; sites not using Repeatable Fieldsets, or running versions outside 3.10.4-3.14.9, are not exposed.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N, 9.3) shows a network-reachable, low-complexity, unauthenticated vector whose only meaningful gate is UI:A - an administrator must open the submissions view, an action that is routine for any site processing forms. The subsequent-system impacts (SC:H/SI:H) correctly capture that code runs in the privileged admin context, not just the vulnerable component. Mitigating the raw severity: exploitation is not automatable end-to-end because it hinges on that admin-view step, and there is no KEV listing and no public POC, so this reads as latent risk rather than confirmed active or widespread exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Confidence in the CVSS signal is high because the vector aligns cleanly with the described mechanism.

An unauthenticated attacker locates a public Ninja Forms form using a Repeatable Fieldset, submits it with a crafted repeater child key such as '<script>...</script>' as the submission index, and the payload is stored. When a site administrator later opens the submissions view in wp-admin, the script executes in their authenticated session and can steal cookies or silently create a new administrator account. No public POC was identified in the input, but the low attack complexity (AC:L) and network vector make weaponization straightforward once the mechanism is known.