kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

• CVE-2026-100151 Medium 6.1 Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter 0.2%
• CVE-2026-100155 Medium 6.5 Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag 0.5%
• CVE-2026-109997 High 7.2 Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization 0.4%
• CVE-2026-101326 Medium 5.4 Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name 0.4%
• CVE-2026-90438 High 7.2 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission 0.3%
• CVE-2026-94504 High 7.2 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting 0.6%