CVE-2026-19769: Ninja Forms WordPress Plugin XSS Vulnerability

CVE-2026-19769 Overview

CVE-2026-19769 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress. The flaw affects all versions up to and including 3.15.1 and stems from insufficient input sanitization and output escaping in the plugin's submission handler. Unauthenticated attackers can inject arbitrary JavaScript that executes when users visit an attacker-controlled page served from the site's own origin. Exploitation requires the Ninja Forms File Uploads add-on to be active on the target site.

Critical Impact
Unauthenticated attackers can write attacker-supplied HTML files containing arbitrary JavaScript into web-server-writable directories, including the WordPress site root, and have the payload served from the site's trusted origin.

Affected Products

Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress, all versions through 3.15.1
Ninja Forms File Uploads add-on (required to be active for exploitation)
WordPress sites where the web server has write access to the site root or other served directories

Discovery Timeline

2026-09-05 - CVE-2026-19769 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in the NVD database

Technical Details for CVE-2026-19769

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX submission controller at includes/AJAX/Controllers/Submission.php. Ninja Forms accepts repeater field submissions containing child entries keyed by field type. When an attacker submits a child entry with a type value that is not present in the allowlist, the plugin fails to reject it. Instead, the unmatched child is routed through the File Uploads handler.

The File Uploads handler then treats the attacker-supplied payload as an upload operation. This allows an unauthenticated attacker to write an HTML file with arbitrary JavaScript into any directory writable by the web server, including the site root. Because the file is served from the same origin as the WordPress site, the injected script executes with full access to that origin's cookies, session storage, and DOM.

Root Cause

The root cause is type confusion caused by an unmatched array key combined with missing input sanitization and output escaping. The submission handler does not validate that the child type value is a whitelisted repeater child type before dispatching the entry. Downstream, the File Uploads handler trusts the caller-supplied filename and content, so arbitrary HTML containing JavaScript is written to disk without escaping or type restriction.

Attack Vector

Exploitation is network-based, requires no authentication, and requires no user interaction to plant the payload. The attacker submits a crafted Ninja Forms submission whose repeater child carries a non-whitelisted type. The plugin routes the entry through File Uploads, which writes an attacker-controlled .html file into a served directory. Any visitor who subsequently loads that URL executes the injected script under the site's origin, enabling session theft, forced administrative actions via authenticated victims, or drive-by redirection.

See the Ninja Forms Changeset 3674413 and the Wordfence Vulnerability Report for the corrected code paths.

Detection Methods for CVE-2026-19769

Indicators of Compromise

Unexpected .html or .htm files in the WordPress site root or other web-server-writable directories, especially with recent creation timestamps and non-standard filenames
HTTP POST requests to the Ninja Forms submission AJAX endpoint containing repeater child entries with unusual or unknown type values
Outbound network callbacks from browsers to attacker-controlled domains shortly after visitors load newly created HTML files on the site

Detection Strategies

Audit the file system for newly created HTML files outside of expected WordPress and plugin content directories, and diff against a known-good baseline
Inspect web server access logs for POSTs to admin-ajax.php invoking the Ninja Forms submission action with anomalous JSON payload structure
Review Ninja Forms submission logs for entries whose repeater children reference field types not defined by the installed plugin configuration

Monitoring Recommendations

Enable file integrity monitoring on the WordPress document root and wp-content directories to alert on new writable HTML content
Monitor for spikes in requests to Ninja Forms submission endpoints from single IP addresses or user agents
Track browser console errors and Content Security Policy (CSP) violation reports that indicate execution of unexpected inline scripts

How to Mitigate CVE-2026-19769

Immediate Actions Required

Update the Ninja Forms plugin to version 3.15.2 or later on all WordPress installations
If immediate patching is not possible, deactivate the Ninja Forms File Uploads add-on to break the exploitation chain
Scan the site root and other web-writable directories for unauthorized HTML files and remove any that are not expected

Patch Information

The vendor fixed the vulnerability in Ninja Forms 3.15.2. The patch is applied in includes/AJAX/Controllers/Submission.php and enforces validation of repeater child type values so that unmatched keys no longer reach the File Uploads handler. Review the Ninja Forms Version Change 3.15.1 to 3.15.2 diff and the Ninja Forms Changeset Comparison for the exact code changes.

Workarounds

Restrict web server write permissions on the WordPress site root so PHP cannot create files outside of wp-content/uploads
Deploy a web application firewall (WAF) rule to block Ninja Forms submissions whose repeater child type values are not in the plugin's allowlist
Enforce a strict Content Security Policy that disallows inline script execution and restricts script sources to trusted origins

bash

# Example: restrict web server write access to the WordPress site root
# Adjust ownership so PHP-FPM cannot write to the document root
chown -R root:www-data /var/www/wordpress
find /var/www/wordpress -type d -exec chmod 755 {} \;
find /var/www/wordpress -type f -exec chmod 644 {} \;

# Allow writes only to the uploads directory
chown -R www-data:www-data /var/www/wordpress/wp-content/uploads
chmod -R 755 /var/www/wordpress/wp-content/uploads