Ninja Forms EUVD-2026-91177

Exploitation requires that the targeted form contains a Paragraph Text field with the Rich Text Editor (RTE) option explicitly enabled - this is a per-field, non-default setting, so forms without RTE-enabled Paragraph Text fields are not affected. Given CVSS PR:N/UI:N, the payload can be planted by an unauthenticated attacker with no user interaction via normal form submission against versions up to and including 3.15.4. The primary limiting factors are: the non-default RTE configuration dependency, and that script execution (the actual impact) is deferred until a victim - typically an authenticated administrator - views the stored submission, meaning impact depends on an admin accessing the injected content.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Ninja Forms WordPress plugin, reported by Wordfence, with a provided CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The network vector, low complexity, and no-privileges requirement mean an unauthenticated attacker can plant the payload remotely via a public form, and the Scope:Changed metric reflects that the injected script executes in a different security context (typically an administrator's browser when viewing the stored submission). Weighing the signals: no EPSS score is provided, there is no CISA KEV listing, and no public proof-of-concept is indicated - so despite a High CVSS, there is no evidence of real-world exploitation at this time. A crucial mitigating factor tempers the raw score: the description states exploitation is ONLY possible when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled, which is a non-default, per-field configuration rather than an out-of-the-box condition. Net assessment: a genuine but conditional stored-XSS issue worth patching promptly on sites that use RTE-enabled Paragraph Text fields, but not an emergency mass-exploitation threat on the basis of the data available - treat as medium-to-high operational priority rather than critical. Note that the CVSS C:L/I:L impact pairing is typical of admin-session XSS; confirm against the Wordfence advisory for field-specific details.

An unauthenticated attacker submits a Ninja Forms form whose Paragraph Text field has the Rich Text Editor option enabled, embedding a malicious script in the field value because input is insufficiently sanitized and output insufficiently escaped. When a site administrator later opens that submission in the WordPress dashboard, the stored script executes in their authenticated session, enabling actions such as session/cookie theft or admin-context operations. No public exploit code is identified at time of analysis, but the attack requires no authentication and no attacker-side user interaction to plant the payload.