CVE-2026-95515: WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Ninja Forms pluginto a version that resolves this vulnerability.Fixed in 3.15.4
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The issue is described as unauthenticated, so the attacker does not need a Ninja Forms or WordPress account. The CVSS vector indicates network-reachable exploitation with low attack complexity, but user interaction is required.
Which installations are affected?
Ninja Forms versions 3.15.3 and earlier are identified as affected. The provided data does not state whether a particular form configuration or feature must be enabled.
What is the potential impact if exploitation succeeds?
The vulnerability can allow cross-site scripting, with low impacts to confidentiality, integrity, and availability according to the supplied CVSS vector. Its scope is changed, meaning impacts may extend beyond the vulnerable component's security authority.