What’s Vulnerable › Vulnerabilities
CVE-2026-92438: Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-22 · updated 2026-09-22
- Weakness: CWE-79
Description
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
Affected products
- kstover Ninja Forms – The Contact Form Builder That Grows With You: from 3.15.3 before 3.15.4 — fixed in 3.15.4
How to fix
Upgrade to a fixed version: kstover Ninja Forms – The Contact Form Builder That Grows With You 3.15.4. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-92438 or the next vulnerability affects your stack