Stored Script Vulnerability in Ninja Forms by WP Ninjas

CVE-2026-94504

What is CVE-2026-94504?

CVE-2026-94504 is a stored script vulnerability affecting Ninja Forms, a popular plugin for the WordPress content management system. This vulnerability resides in version 3.15.3 of Ninja Forms, where an anonymous non-rich text editor (RTE) textarea value is stored and rendered without proper HTML encoding within the legacy submission editor. The flaw allows an attacker to inject malicious scripts that can break out of the textarea context. Consequently, when an administrator accesses the direct submission URL known to the attacker, the malicious script executes within the WordPress admin environment. This execution can have detrimental effects on an organization, as it could lead to unauthorized access, data manipulation, or the compromise of sensitive information through the WordPress admin interface.

Potential impact of CVE-2026-94504

1. Unauthorized Access: The execution of injected scripts in the WordPress admin area can enable attackers to gain administrative privileges, allowing them to manipulate site content, change settings, or install additional malicious components.

2. Data Breach: With the ability to run scripts on the admin interface, attackers could extract sensitive data from the site, including user information, submission records, and potentially other private information stored in the WordPress database.

3. Site Integrity Compromise: Malicious scripts can lead to defacement of the website, redirecting users to fraudulent pages, or spreading malware to site visitors, harming the organization’s reputation and eroding user trust.

References