CVE-2026-81773: WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability
Published Sep 3, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
Affected Software
1 affected component
wordpress/Ninja Forms File Uploads Extension<=3.3.26
Event History
Sep 3, 2026
CVE Published
via MITRE·04:31 PM
Data Sourced
via MITRE·04:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or plugin-level privileges. Exploitation requires user interaction.
2
What impact can successful exploitation have?
The reported CVSS vector indicates low-impact confidentiality, integrity, and availability effects, with scope changed. The issue is classified as cross-site scripting.
3
Which plugin versions are affected?
Ninja Forms File Uploads Extension versions 3.3.26 and earlier are identified as affected.