Security Alert Summary
Ninja Forms 3.15.3 contains a stored cross-site scripting issue in the legacy submission editor. An anonymous non-RTE textarea value is stored and later rendered without safe HTML encoding, allowing an attacker to inject script that executes when an Administrator opens a direct submission URL in the WordPress admin origin.
CVE Details
- CVE ID: CVE-2026-94504
- Affected component: Ninja Forms 5.3 (legacy submission editor rendering of textarea values)
- Affected versions: 3.15.3 and earlier (as indicated by <= 3.15.3)
- Published: September 22, 2026 at 7:16:31 AM UTC
- Last modified: September 22, 2026 at 3:17:24 PM UTC
- CVSS v3.1 base score: 7.2
- CVSS severity: HIGH
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impacts: Confidentiality: Low; Integrity: Low; Availability: None
- CWE / weakness ID: CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue arising because an anonymous, non-RTE textarea value is stored and later rendered in the plugin’s legacy submission editor without safe HTML encoding. According to the report, the stored textarea content can break out of the expected textarea context and include a <script> payload. When an Administrator visits the attacker-known direct submission URL in the WordPress admin, the injected script runs within the WordPress admin origin.
The project files referenced in the report point to rendering and storage locations where the unsafe handling occurs, including:
includes/Database/Models/Submission.php(referenced at a specific line)includes/Fields/Textarea.php(textarea field handling)includes/Templates/admin-metabox-sub-fields.html.php(legacy admin submission editor template)
The core issue is missing safe HTML encoding of stored textarea values before output in the legacy admin template. The impact is limited to the privileges and context in which the stored content is rendered: script executes in the admin origin when an Administrator opens the specific submission view, producing confidentiality and integrity impacts consistent with the CVSS metrics (e.g., possible exposure or modification of data accessible in that admin context).
How This Could Impact Your Website
Consider a site where multiple users interact with forms: a site owner, internal staff who review submissions, and an external contractor who occasionally inspects content. An attacker could submit a specially crafted textarea value that is stored with a script payload. If an Administrator later opens the direct submission URL in the legacy submission editor, that script can execute in the admin origin.
Practical consequences include the potential exposure of data visible in the admin context (for example, internal user email addresses displayed alongside the submission) and an increased risk of targeted phishing or social engineering against staff based on information available in the admin interface. The issue does not, based on the provided data, indicate automatic full-site compromise, but it does present a realistic vector for focused attacks against administrative users.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other low-privilege users who can submit form entries.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site and admin activity logs for unusual behavior, especially access to direct submission URLs or unexpected admin page visits.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Database/Models/Submission.php#L205
- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Fields/Textarea.php#L35
- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Templates/admin-metabox-sub-fields.html.php#L23
- https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Fields/Textarea.php#L35
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3705719%40ninja-forms%2Ftags%2F3.15.4&old=3685242%40ninja-forms%2Ftags%2F3.15.3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c599a562-5218-4b37-bcf7-0e82008a4e68?source=cve
