Live › vulnerability › CVE-2026-101326
The Ninja Forms WordPress plugin passes a user-controlled value to do_shortcode without validation in versions up to and including 3.15.5. An authenticated subscriber can set their display name to a shortcode string and have it executed when a page with a vulnerable form field is visited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 06:33 UTC. All times on this page are UTC.
Sites running Ninja Forms up to and including 3.15.5 that allow subscriber accounts and have at least one form field on a public page using the {wp:user_display_name} merge tag. Sites without that configuration or without subscriber-level accounts are much less exposed.
No product ranges from the sources yet.
3.15.5.{wp:user_display_name} on public pages.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an administrator has configured at least one Ninja Forms field with its Default Value set to the {wp:user_display_name} merge tag on a publicly accessible page; a Subscriber need only set their display_name to a shortcode string via their profile and then visit that page.
This page as .md · .json · in your agent: get_signal("CVE-2026-101326")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.