Live › vulnerability › CVE-2026-110899
Go to dashboardNinja Forms, a WordPress form-builder plugin, does not neutralize some input before rendering it on a page, so the input is stored and shown to other visitors. An attacker can run scripts in the browser of anyone who views the affected page, such as an admin.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ninja Forms plugin at version 3.15.5 or earlier are in scope, since the stored XSS sits in the plugin's form handling. Sites that do not have Ninja Forms installed can skip it. Whether an anonymous visitor can submit the payload or only a logged-in user is not stated in the sources.
No product ranges from the sources yet.
wp plugin get ninja-forms --field=version3.15.5; versions up to and including it are listed as affected3.15.5 (the advisory does not name the fixed release; unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-110899")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.