CVE-2026-95515: Ninja Forms XSS Vulnerability

CVE-2026-95515 Overview

CVE-2026-95515 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Ninja Forms WordPress plugin in versions up to and including 3.15.3. The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Attackers can inject malicious script content that executes in the browser of any user who interacts with a crafted request or link. Because authentication is not required, exploitation can target site visitors and administrators alike. The scope-changed nature of the flaw means executed script can affect resources beyond the vulnerable component.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, administrative account takeover, and defacement of WordPress sites running Ninja Forms <= 3.15.3.

Affected Products

Ninja Forms plugin for WordPress, versions <= 3.15.3
WordPress sites with Ninja Forms installed and publicly reachable
Any WordPress environment where site visitors can interact with Ninja Forms endpoints

Discovery Timeline

2026-09-23 - CVE-2026-95515 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95515

Vulnerability Analysis

The vulnerability resides in the Ninja Forms plugin, a widely deployed WordPress form builder. Input supplied through plugin-controlled parameters is rendered back into HTML output without sufficient neutralization of script-relevant characters.

An unauthenticated attacker crafts a request or URL containing JavaScript payloads. When a victim's browser loads the resulting page, the injected script executes in the site's origin. User interaction is required, typically clicking a malicious link or visiting a crafted page.

Because the impact scope changes across security boundaries, the executed script can access cookies, session tokens, and DOM data belonging to the WordPress application context. This enables session hijacking, forced administrative actions through the WordPress REST API, and delivery of secondary payloads to visitors.

Root Cause

The root cause is improper output encoding of user-controlled data before it is inserted into HTML responses (CWE-79). Ninja Forms <= 3.15.3 fails to apply context-appropriate escaping, allowing attacker-supplied markup to be interpreted as executable script rather than inert text.

Attack Vector

Exploitation is network-based and requires no privileges. The attacker delivers a crafted link or embedded content to a victim. When the victim loads the page containing the reflected or stored payload, script executes in the WordPress origin. See the Patchstack advisory for technical details on the injection sink.

Detection Methods for CVE-2026-95515

Indicators of Compromise

Web server access logs containing HTML tags, javascript: URIs, or event handler attributes (for example onerror=, onload=) in Ninja Forms request parameters
Unexpected administrator account creation, plugin installation, or theme modification following visits to Ninja Forms pages
Outbound requests from browser sessions to unknown domains sourced from WordPress pages hosting Ninja Forms

Detection Strategies

Inspect HTTP request bodies and query strings targeting Ninja Forms endpoints for URL-encoded <script>, <svg>, or event handler patterns
Correlate WordPress audit logs with reflected content in HTTP responses to identify successful injection
Deploy a Web Application Firewall (WAF) ruleset that flags XSS payload signatures against /wp-admin/admin-ajax.php and Ninja Forms routes

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script execution attempts
Monitor WordPress user role changes and privileged action logs for anomalies following external referrer traffic
Track plugin version inventory across managed WordPress sites and alert on installations of Ninja Forms <= 3.15.3

How to Mitigate CVE-2026-95515

Immediate Actions Required

Update the Ninja Forms plugin to the fixed release published after version 3.15.3 on all WordPress instances
Audit administrator accounts, sessions, and recent plugin or theme changes for signs of unauthorized activity
Rotate WordPress administrator passwords and invalidate active sessions if exploitation is suspected

Patch Information

Refer to the Patchstack Ninja Forms XSS advisory for the vendor-supplied fixed version and upgrade guidance. Apply the patched release through the WordPress plugin manager or WP-CLI.

Workarounds

Deactivate the Ninja Forms plugin until the patched version can be installed
Deploy WAF rules that block XSS payload signatures targeting Ninja Forms request parameters
Enforce a restrictive Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Update Ninja Forms via WP-CLI on the affected host
wp plugin update ninja-forms --version=<patched-version>
wp plugin list --name=ninja-forms --fields=name,status,version