Vulnerability · Published Sep 22, 2026 · Assigned by WPScan
CVE-2026-92438Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
High 8.8
In plain English
A high-severity cross-site scripting in Ninja Forms from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 66.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Ninja Forms | 3.15.3 – before 3.15.4 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/eeed1378-2c51-4d38-9dda-4a13ce330b25/ exploit, vdb-entry, technical-description