CVE-2026-110899: WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

Ninja Forms versions through 3.15.5 are affected. The provided data does not identify a fixed version or any configuration-specific exclusions.

Q: What does exploitation require?

The vector is network-accessible and requires no attacker privileges, but it does require user interaction. Successful exploitation can result in stored XSS with low impact to confidentiality, integrity, and availability, including across a changed security scope.

Published Oct 21, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.

Affected Software

1 affected component

Kevin Stover Ninja Forms<=3.15.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade wordpress/ninja-forms to a version that resolves this vulnerability.
Fixed in 3.15.6

Event History

Oct 21, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Ninja Forms versions through 3.15.5 are affected. The provided data does not identify a fixed version or any configuration-specific exclusions.

What does exploitation require?