Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck
CVE-2026-65048Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
Critical 9.3
In plain English
A critical-severity cross-site scripting in Ninja Forms from Saturday Drive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Saturday Drive | Ninja Forms | 3.10.4 – before 3.14.9 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N