CVE-2026-94504
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
Early warning: exploitation observed
- Exploitation observed since Oct 6, 2026
- Not yet in the official CISA catalogue
- First attack observed 14 days after disclosure
Source: VulnCheck KEV · Oct 6, 2026
CVSS score7.2 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NWeakness type (CWE)CWE-79
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.