Reflected DOM-Based Cross-Site Scripting in Ninja Forms by WordPress

CVE-2026-100151

What is CVE-2026-100151?

The Ninja Forms – Contact Form Builder plugin for WordPress is susceptible to Reflected DOM-Based Cross-Site Scripting due to inadequate input sanitization and output escaping. This vulnerability allows unauthenticated attackers to insert arbitrary web scripts into pages. By manipulating the 'querystring:' URL parameter, an attacker can trick a user into clicking a link, leading to the execution of malicious scripts. This is facilitated by the server's failure to properly handle the {field:*} placeholder, allowing it to render unsafe content from the raw query string instead.

References