blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-94504

HIGH 7.2 CVSS 3.1
Published
September 22, 2026
Last modified
September 22, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Description

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.

Affected WordPress components

  • Ninja Forms – The Contact Form Builder That Grows With You Plugin · ninja-forms
    Confirmed match Active
    Up to and including 3.15.3
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder — Up to and including 3.15.3

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Database/Models/Submission.php#L205
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Fields/Textarea.php#L35
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Templates/admin-metabox-sub-fields.html.php#L23
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Fields/Textarea.php#L35
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?reponame=&new=3705719%40ninja-forms%2Ftags%2F3.15.4&old=3685242%40ninja-forms%2Ftags%2F3.15.3
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/c599a562-5218-4b37-bcf7-0e82008a4e68?source=cve
  • nvd.nist.gov Official NVD record