CVE-2026-19769
Received Received - Intake

Stored XSS in Ninja Forms WordPress Plugin via Repeater Child Type Confusion

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Wordfence

Description
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-19769
EUVD
EUVD-2026-71880

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ninja_forms ninja_forms to 3.15.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Ninja Forms WordPress plugin. It occurs due to insufficient input sanitization and output escaping in versions up to 3.15.1. Unauthenticated attackers can inject malicious scripts into pages by exploiting a type confusion issue via an unmatched array key. The attack requires the Ninja Forms File Uploads add-on to be active and writes an attacker-supplied HTML file containing JavaScript into a writable directory, including the site root.

Detection Guidance

Detection requires checking for the presence of vulnerable Ninja Forms versions and the File Uploads add-on. Inspect WordPress plugins directory for versions up to 3.15.1. Check server logs for unexpected HTML file uploads or script injections in web directories.

Impact Analysis

This vulnerability allows attackers to inject and execute arbitrary JavaScript in pages viewed by users. This could lead to theft of session cookies, account takeovers, defacement of websites, or redirection to malicious sites. Users accessing infected pages may have their data compromised without realizing it.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines, legal liabilities, and reputational damage if exploited, as it undermines data confidentiality and integrity.

Mitigation Strategies

Update Ninja Forms to the latest version beyond 3.15.1. Disable the Ninja Forms File Uploads add-on if not required. Review server directories for unauthorized HTML files and remove them. Implement strict file upload restrictions and sanitize all user inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19769. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart