Ninja Forms Contact Form Builder With Calculators Quizzes Signatures Ai Form Builder
Monthly
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected DOM-based cross-site scripting in the Ninja Forms WordPress plugin, affecting all versions up to and including 3.15.5, allows unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when the crafted link is clicked (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is conditional: the target page must render a Ninja Forms form that uses the {field:*} merge-tag placeholder, and the attacker must supply a matching 'querystring:<key>'/'field:<key>' URL parameter so the server fully resolves the placeholder, after which the client-side else-branch abandons the server-sanitized value and reconstructs the field content from the raw query string. There is no server-side-only, no-interaction path - the required victim interaction keeps realistic risk targeted rather than widespread, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects all versions up to and including 3.15.5. A form-processing action - associated in the cited source with the SuccessMessage action and the AJAX submission controller - passes an insufficiently validated value into do_shortcode(), allowing a remote attacker with no privileges to have arbitrary registered shortcodes rendered and executed. Impact is bounded because severity depends on which shortcodes the target site exposes (CVSS caps confidentiality and integrity at Low and availability at None); no public exploit has been identified at time of analysis, and the vendor has released 3.15.6 as the fixed version.
Arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects every version up to and including 3.15.5: any authenticated user with Subscriber-level access can place a shortcode string in their profile display name and have it executed by do_shortcode() wherever the {wp:user_display_name} merge tag is rendered. Exploitation is not possible on a default install - an administrator must first have set a Ninja Forms field's Default Value to that merge tag and placed the form on a publicly accessible page, and the resulting impact is bounded by whichever shortcodes are registered on the target site. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assigned priority is this_month, reflecting a moderate-severity, low-urgency configuration-dependent flaw rather than an emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) through version 3.15.5 allows an unauthenticated attacker to plant arbitrary script in the site's stored form data via the 'formData.extra' parameter, which is insufficiently sanitized on input and insufficiently escaped on output. Because the nf_ajax_submit endpoint hands a valid nonce to any requester on failure, the nonce check is effectively neutralized and the payload can be delivered in a single unauthenticated request; the script then executes when a victim - typically an administrator reviewing submissions or calculations - loads the page that renders the stored value. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (7.2), reflecting session-scoped confidentiality and integrity impact within the victim's browser; no public exploit code or CISA KEV entry was identified at time of analysis, and the vulnerability is tagged as a this_week priority rather than an emergency.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions up to and including 3.15.4) enables unauthenticated attackers to inject arbitrary web scripts into form submissions, which then execute when a victim-typically an authenticated administrator-views the stored entry. Exploitation is contingent on the targeted form containing a Paragraph Text field with the non-default Rich Text Editor (RTE) option explicitly enabled, per the independent assessment. The CVSS 3.1 score is 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting unauthenticated remote exploitation with changed scope but limited confidentiality and integrity impact; no public exploit code or CISA KEV entry was identified at time of analysis.
Stored cross-site scripting in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) versions up to and including 3.15.3 allows an unauthenticated visitor to submit a plain, non-rich-text textarea field value that is persisted and later rendered without HTML encoding in the plugin's legacy submission editor, so a crafted payload breaks out of the textarea element and executes as script. The script runs in the WordPress admin origin, but only when a logged-in Administrator opens the specific, attacker-known direct submission URL - meaning the attack requires victim interaction and does not fire automatically. Severity is rated 7.2 (High) by the vendor, while our independent assessment adjusts the vector to UI:R because the described trigger is a manual admin click, clarifying that real-world exploitability is lower than the vendor score implies; no public exploit code or confirmed active exploitation was identified at time of analysis.
Reflected DOM-based cross-site scripting in the Ninja Forms WordPress plugin, affecting all versions up to and including 3.15.5, allows unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser when the crafted link is clicked (CVSS 6.1; CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Exploitation is conditional: the target page must render a Ninja Forms form that uses the {field:*} merge-tag placeholder, and the attacker must supply a matching 'querystring:<key>'/'field:<key>' URL parameter so the server fully resolves the placeholder, after which the client-side else-branch abandons the server-sanitized value and reconstructs the field content from the raw query string. There is no server-side-only, no-interaction path - the required victim interaction keeps realistic risk targeted rather than widespread, and no public exploit was identified at time of analysis.
Unauthenticated arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects all versions up to and including 3.15.5. A form-processing action - associated in the cited source with the SuccessMessage action and the AJAX submission controller - passes an insufficiently validated value into do_shortcode(), allowing a remote attacker with no privileges to have arbitrary registered shortcodes rendered and executed. Impact is bounded because severity depends on which shortcodes the target site exposes (CVSS caps confidentiality and integrity at Low and availability at None); no public exploit has been identified at time of analysis, and the vendor has released 3.15.6 as the fixed version.
Arbitrary shortcode execution in the WordPress plugin Ninja Forms (Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder) affects every version up to and including 3.15.5: any authenticated user with Subscriber-level access can place a shortcode string in their profile display name and have it executed by do_shortcode() wherever the {wp:user_display_name} merge tag is rendered. Exploitation is not possible on a default install - an administrator must first have set a Ninja Forms field's Default Value to that merge tag and placed the form on a publicly accessible page, and the resulting impact is bounded by whichever shortcodes are registered on the target site. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assigned priority is this_month, reflecting a moderate-severity, low-urgency configuration-dependent flaw rather than an emergency.