Stored Cross-Site Scripting in Ninja Forms - Excel Export Plugin for WordPress

CVE-2026-15161

What is CVE-2026-15161?

The Ninja Forms - Excel Export plugin for WordPress has a vulnerability that allows authenticated users with a subscriber-level role or higher to execute arbitrary web scripts. The issue arises from improper handling of user input in the save_filter() AJAX handler, which saves the raw input data to a WordPress option without validating user capabilities, verifying nonces, or sanitizing inputs. This unfiltered data can later be output directly into the HTML attributes of the admin Excel Export screen, risking script injection and potential exploitation whenever an admin accesses affected pages.

References