PT-2026-61951 · Saturday Drive · Ninja Forms

Pavel Kohout · CVE-2026-65048 · Publicado 2026-07-21 · Atualizado 2026-07-21

NVD

CVSS v3.1

9.3

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin form element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-65048

Produtos afetados

Ninja Forms

Referências · 4

• https://wordpress.org/plugins/ninja-forms/changelog · Correção
• https://wordpress.org/plugins/ninja-forms · Nota
• https://vulncheck.com/advisories/ninja-forms-unauthenticated-stored-cross-site-scripting-via-repeatable-fieldset-submission-index · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-65048 · Nota de Segurança