CVE-2026-65048
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature. The parseSubmissionIndex() function accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel.
Risk Assessment
The risk for the organization includes session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content, potentially leading to full compromise of the WordPress site.
Recommendation
It is recommended to immediately update the Ninja Forms plugin to the latest available version that fixes this vulnerability. Until the update is applied, restrict access to the WordPress admin panel and monitor form submissions for suspicious entries.
Original NVD description (English source)
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.