CVE-2026-80437
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Risk Assessment
An attacker could execute arbitrary shortcodes, potentially leading to data disclosure or unauthorized actions within the site context.
Recommendation
Update the Ninja Forms plugin to version 3.15.2 or later.
Other vulnerabilities in Ninja Forms WordPress plugin
See all- CVE-2025-11924High
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
- CVE-2023-4109Medium
The Ninja Forms plugin for WordPress before version 3.6.26 was affected by an HTML Injection security vulnerability.
Original NVD description (English source)
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS