CVE-2026-11363

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms versions up to 3.15.3. An attacker can inject malicious script without authentication.

The Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.

The Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature. The parseSubmissionIndex() function accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel.

The Ninja Forms plugin for WordPress before version 3.0.23 (when the Uploads add-on is activated) contains path traversal and unrestricted file upload vulnerabilities. This allows an attacker to traverse the file system to access files and execute code via the name and tmp_name parameters in includes/fields/upload.php.

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'querystring:<key>' URL parameter in all versions up to and including 3.15.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute if they can trick a user into performing an action such as clicking a link. The bypass is triggered when an attacker supplies a matching 'field:<key>' URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.5) is vulnerable to arbitrary shortcode execution. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode, enabling unauthenticated attackers to execute arbitrary shortcodes.

The Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint, bypassing CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

The Ninja Forms plugin for WordPress (versions up to and including 3.15.4) is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) field submission due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.