{"id":"CVE-2026-110899","kind":"vulnerability","aliases":["CVE-2026-110899"],"related":[],"title":"Ninja Forms WordPress plugin: stored XSS through form input up to 3.15.5","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.","summary":"Ninja Forms, a WordPress form-builder plugin, does not neutralize some input before rendering it on a page, so the input is stored and shown to other visitors. An attacker can run scripts in the browser of anyone who views the affected page, such as an admin.","severity":"high","cvss":7.1,"epss":0.00146,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ninja-forms","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Ninja Forms plugin version in the WordPress admin under Plugins, or with `wp plugin get ninja-forms --field=version`\n- Compare the version against `3.15.5`; versions up to and including it are listed as affected","fix":"- Update Ninja Forms to a version newer than `3.15.5` (the advisory does not name the fixed release; unknown)","status":"open","published_at":"2026-10-21T08:16:42+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:31:56+00:00","updated_at":"2026-10-25T03:31:56+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:31:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update Ninja Forms to a version newer than `3.15.5` (the advisory does not name the fixed release; unknown)","reach":"internet","title":"Ninja Forms WordPress plugin: stored XSS through form input up to 3.15.5","impact":"medium","summary":"Ninja Forms, a WordPress form-builder plugin, does not neutralize some input before rendering it on a page, so the input is stored and shown to other visitors. An attacker can run scripts in the browser of anyone who views the affected page, such as an admin.","category":"package","nicknames":[],"who_cares":["wordpress","ninja-forms","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker scripts run in admin browsers, enabling account takeover","analyst_note":"Confirm the fixed Ninja Forms version and whether unauthenticated form submissions can trigger the stored payload (see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-110899).","how_to_check":"- Check the installed Ninja Forms plugin version in the WordPress admin under Plugins, or with `wp plugin get ninja-forms --field=version`\n- Compare the version against `3.15.5`; versions up to and including it are listed as affected","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Ninja Forms plugin at version 3.15.5 or earlier are in scope, since the stored XSS sits in the plugin's form handling. Sites that do not have Ninja Forms installed can skip it. Whether an anonymous visitor can submit the payload or only a logged-in user is not stated in the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":3355,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110899':15A,18A '-2026':14A,17A '3.15.5':12A,106C 'admin':74B 'affect':69B,100C 'allow':96C 'anyon':65B 'attack':57B 'browser':63B 'builder':33B 'cross':84C 'cross-sit':83C 'cve':13A,16A 'form':2A,8A,21B,28B,32B,92C,95C,102C 'form-build':31B 'generat':82C 'host':25B 'improp':75C 'input':9A,39B,48B,78C 'issu':99C 'kevin':89C 'n/a':104C 'neutral':37B,76C 'ninja':1A,20B,27B,91C,94C,101C 'ninja-form':19B,93C 'packag':22B 'page':45B,70B,81C 'plugin':4A,34B 'render':41B 'run':59B 'script':60B,86C 'self':24B 'self-host':23B 'shown':52B 'site':85C 'store':5A,50B,97C 'stover':90C 'view':67B 'visitor':55B 'vulner':87C 'web':80C 'wordpress':3A,26B,30B 'xss':6A 'xss.this':98C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ninja Forms plugin at version 3.15.5 or earlier are in scope, since the stored XSS sits in the plugin's form handling. Sites that do not have Ninja Forms installed can skip it. Whether an anonymous visitor can submit the payload or only a logged-in user is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T08:16:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110899","severity":null,"published_at":"2026-10-21T08:16:42+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110899","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110899","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}