Live › vulnerability › CVE-2026-100155
The Ninja Forms contact form plugin for WordPress passes an unvalidated value to do_shortcode, so an action can be triggered that runs arbitrary shortcodes. An unauthenticated attacker can exploit this on any site running a vulnerable version, with impact depending on which shortcodes the site has available.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Any WordPress site with the Ninja Forms plugin installed at version 3.15.5 or earlier is exposed, because the flaw is reachable without logging in. Sites that do not run this plugin are not affected. The sources do not say which shortcodes make the impact worse or whether a fixed version exists.
No product ranges from the sources yet.
wp plugin get ninja-forms --field=version3.15.5No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
This page as .md · .json · in your agent: get_signal("CVE-2026-100155")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.