Kstover
Monthly
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Ninja Forms WordPress plugin (all versions through 3.14.1) lets unauthenticated remote attackers read stored form submissions via the 'ninja-forms-views/token/refresh' REST callback, which lacks an authorization check. Because Ninja Forms submissions frequently capture PII, contact details, and other sensitive user-entered data, this exposes potentially confidential information to anyone who can reach the site. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-auth nature makes it straightforward to abuse.
Reflected DOM-based cross-site scripting in the Ninja Forms WordPress plugin, affecting all versions up to and including 3.15.5, allows unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when the crafted link is clicked (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is conditional: the target page must render a Ninja Forms form that uses the {field:*} merge-tag placeholder, and the attacker must supply a matching 'querystring:<key>'/'field:<key>' URL parameter so the server fully resolves the placeholder, after which the client-side else-branch abandons the server-sanitized value and reconstructs the field content from the raw query string. There is no server-side-only, no-interaction path - the required victim interaction keeps realistic risk targeted rather than widespread, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects all versions up to and including 3.15.5. A form-processing action - associated in the cited source with the SuccessMessage action and the AJAX submission controller - passes an insufficiently validated value into do_shortcode(), allowing a remote attacker with no privileges to have arbitrary registered shortcodes rendered and executed. Impact is bounded because severity depends on which shortcodes the target site exposes (CVSS caps confidentiality and integrity at Low and availability at None); no public exploit has been identified at time of analysis, and the vendor has released 3.15.6 as the fixed version.
Arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects every version up to and including 3.15.5: any authenticated user with Subscriber-level access can place a shortcode string in their profile display name and have it executed by do_shortcode() wherever the {wp:user_display_name} merge tag is rendered. Exploitation is not possible on a default install - an administrator must first have set a Ninja Forms field's Default Value to that merge tag and placed the form on a publicly accessible page, and the resulting impact is bounded by whichever shortcodes are registered on the target site. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assigned priority is this_month, reflecting a moderate-severity, low-urgency configuration-dependent flaw rather than an emergency.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Ninja Forms plugin for WordPress versions up to 3.14.1 exposes authorization tokens via an insecure callback function in blocks/bootstrap.php, allowing authenticated Contributor-level users and above to access form submission data from arbitrary forms without proper authorization. The vulnerability enables sensitive information disclosure affecting all WordPress installations using the affected plugin versions, with no active exploitation confirmed at time of analysis.
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Ninja Forms WordPress plugin (all versions through 3.14.1) lets unauthenticated remote attackers read stored form submissions via the 'ninja-forms-views/token/refresh' REST callback, which lacks an authorization check. Because Ninja Forms submissions frequently capture PII, contact details, and other sensitive user-entered data, this exposes potentially confidential information to anyone who can reach the site. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-auth nature makes it straightforward to abuse.
Reflected DOM-based cross-site scripting in the Ninja Forms WordPress plugin, affecting all versions up to and including 3.15.5, allows unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when the crafted link is clicked (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is conditional: the target page must render a Ninja Forms form that uses the {field:*} merge-tag placeholder, and the attacker must supply a matching 'querystring:<key>'/'field:<key>' URL parameter so the server fully resolves the placeholder, after which the client-side else-branch abandons the server-sanitized value and reconstructs the field content from the raw query string. There is no server-side-only, no-interaction path - the required victim interaction keeps realistic risk targeted rather than widespread, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects all versions up to and including 3.15.5. A form-processing action - associated in the cited source with the SuccessMessage action and the AJAX submission controller - passes an insufficiently validated value into do_shortcode(), allowing a remote attacker with no privileges to have arbitrary registered shortcodes rendered and executed. Impact is bounded because severity depends on which shortcodes the target site exposes (CVSS caps confidentiality and integrity at Low and availability at None); no public exploit has been identified at time of analysis, and the vendor has released 3.15.6 as the fixed version.
Arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects every version up to and including 3.15.5: any authenticated user with Subscriber-level access can place a shortcode string in their profile display name and have it executed by do_shortcode() wherever the {wp:user_display_name} merge tag is rendered. Exploitation is not possible on a default install - an administrator must first have set a Ninja Forms field's Default Value to that merge tag and placed the form on a publicly accessible page, and the resulting impact is bounded by whichever shortcodes are registered on the target site. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assigned priority is this_month, reflecting a moderate-severity, low-urgency configuration-dependent flaw rather than an emergency.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Ninja Forms plugin for WordPress versions up to 3.14.1 exposes authorization tokens via an insecure callback function in blocks/bootstrap.php, allowing authenticated Contributor-level users and above to access form submission data from arbitrary forms without proper authorization. The vulnerability enables sensitive information disclosure affecting all WordPress installations using the affected plugin versions, with no active exploitation confirmed at time of analysis.