CVE-2026-94504: Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using Ninja Forms 3.15.3 are exposed when they accept anonymous submissions containing a non-RTE textarea field and administrators review submissions through the legacy submission editor.
What does an attacker need to exploit it?
An attacker needs to submit a crafted value to an anonymous non-RTE textarea field, then cause an Administrator to open the direct URL for that submission in the legacy submission editor.
What is the impact when exploitation succeeds?
The attacker-controlled script executes in the WordPress admin origin when the Administrator opens the affected submission.