CVE-2026-65048
Received Received - Intake

Stored XSS in Ninja Forms WordPress Plugin

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-65048
EUVD
EUVD-2026-46267

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ninja_forms ninja_forms From 3.10.4 (inc) to 3.14.9 (inc)
wpninjas ninja_forms From 3.10.4 (inc) to 3.14.9 (inc)
wpninjas ninja_forms to 3.14.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-65048 is an unauthenticated stored cross-site scripting (XSS) vulnerability in the Ninja Forms WordPress plugin versions 3.10.4 through 3.14.9. It exists in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation. The admin_form_element() function then interpolates these indexes directly into HTML without escaping, allowing malicious scripts to execute when an administrator views form submissions.

Detection Guidance

Check if your Ninja Forms plugin version is between 3.10.4 and 3.14.9. Use WordPress admin panel to inspect plugin versions or run: wp plugin list --name=ninja-forms. Also review form submissions for unusual repeater child keys containing script-like payloads.

Impact Analysis

An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious scripts. When an administrator views the submissions, the payload executes in their browser. This can lead to session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, including personal or health information, if exploited. For GDPR, it may result in data breaches requiring notification to authorities and affected individuals. For HIPAA, it could compromise protected health information, leading to compliance violations and penalties.

Mitigation Strategies

Update Ninja Forms plugin to version 3.14.10 or later immediately. If updating is not possible, disable the Repeatable Fieldset feature or restrict form submissions to trusted users. Monitor admin panel for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart