CVE-2026-101326
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
Risk Assessment
A low-privileged attacker could execute arbitrary shortcodes, potentially leading to information disclosure or other unwanted actions. However, exploitation requires an administrator to have configured a Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag on a publicly accessible page.
Recommendation
Update the Ninja Forms plugin to a version later than 3.15.5. Until then, avoid using the {wp:user_display_name} merge tag as a default value in form fields on public pages.
Other vulnerabilities in Ninja Forms
See all- CVE-2026-102385High
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms versions up to 3.15.3. An attacker can inject malicious script without authentication.
- CVE-2026-65049Critical
The Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
- CVE-2026-65048Critical
The Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature. The parseSubmissionIndex() function accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel.
- CVE-2019-10869High
The Ninja Forms plugin for WordPress before version 3.0.23 (when the Uploads add-on is activated) contains path traversal and unrestricted file upload vulnerabilities. This allows an attacker to traverse the file system to access files and execute code via the name and tmp_name parameters in includes/fields/upload.php.
- CVE-2026-100151Medium
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'querystring:<key>' URL parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The bypass is triggered when an attacker supplies a matching 'field:<key>' URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.
- CVE-2026-109997High
The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-100155Medium
The Ninja Forms plugin for WordPress (versions up to and including 3.15.5) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.
- CVE-2026-67187High
The Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint, bypassing CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
- CVE-2026-90438High
The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.
- CVE-2026-95515High
The Ninja Forms plugin in versions up to and including 3.15.3 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious script into the page.
Original NVD description (English source)
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag on a publicly accessible page; a Subscriber need only set their display_name to a shortcode string via their profile and then visit that page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS