EUVD-2026-54201
GHSA-2xwp-m9v6-767p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
AC:H reflects the non-default dual configuration prerequisite; C:L/I:L because impact is bounded to registered shortcode execution, not arbitrary code.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.
AnalysisAI
Shortcode injection in the Ninja Forms WordPress plugin (versions before 3.14.10) allows unauthenticated network attackers to execute arbitrary WordPress shortcodes registered on a target site by supplying crafted query-string parameters that are processed without sanitization as form field default values. Exploitation is constrained by a non-default site configuration requirement - a form must be configured with query-string pre-population and embedded on a public page - which the CVSS AC:H rating reflects. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-supplied patch (3.14.10) is available.
Technical ContextAI
WordPress shortcodes are bracket-delimited macros (e.g., [gallery id=1]) that the WordPress core processes via do_shortcode() into HTML output or functional side-effects at render time. Ninja Forms supports pre-populating form field default values from URL query-string parameters, a common UX pattern for sharing pre-filled forms via link. The vulnerability arises because the plugin passes this user-controlled query-string value directly into WordPress shortcode processing without sanitization or escaping, treating attacker-supplied input as trusted template content. The CWE was not provided in the source data, but the root cause aligns with CWE-94 (Improper Control of Generation of Code) or CWE-116 (Improper Encoding or Escaping of Output). Affected CPE is inferred from EUVD data as all Ninja Forms plugin releases from version 0 up to but not including 3.14.10.
RemediationAI
Update the Ninja Forms plugin to version 3.14.10 or later, which resolves this issue per vendor advisory. The patched release is available through the WordPress plugin repository and directly from the vendor. Advisory details are at https://wpscan.com/vulnerability/9c96f977-c105-4b45-a3cd-4751fb4aa5a1/. As a compensating control prior to patching, administrators should audit all Ninja Forms configurations and disable query-string pre-population on any form field for any form embedded on a publicly accessible page - this eliminates the attack surface at the cost of breaking legitimate URL-based pre-fill workflows. Alternatively, moving vulnerable forms behind an authentication gate removes public attacker access entirely, though this changes site UX. Generic WAF rules blocking bracket-encoded shortcode syntax in query parameters may reduce risk but are not a reliable substitute for patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Share
External POC / Exploit Code
Leaving vuln.today