PT-2026-61951 · Saturday Drive · Ninja Forms

Pavel Kohout · CVE-2026-65048 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin form element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-65048

Affected Products

Ninja Forms

References · 4

• https://wordpress.org/plugins/ninja-forms/changelog · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-65048 · Security Note
• https://wordpress.org/plugins/ninja-forms · Note
• https://vulncheck.com/advisories/ninja-forms-unauthenticated-stored-cross-site-scripting-via-repeatable-fieldset-submission-index · Note