CVE-2026-65048: Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-10-24
Weakness: CWE-79

Description

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Affected products

kstover Ninja Forms – The Contact Form Builder That Grows With You: from 3.10.4 before 3.14.9 — fixed in 3.14.9

How to fix

Upgrade to a fixed version: kstover Ninja Forms – The Contact Form Builder That Grows With You 3.14.9. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-65048 or the next vulnerability affects your stack