External risk intelligence

Ninja Forms Unauthenticated Stored Cross-Site Scripting Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65048

The vulnerability exists in a WordPress form plugin that is designed to be public-facing to collect user submissions. Because the attack vector involves submitting a public form, which is a standard and intended use case for this software, the exposed surface is inherently internet-facing.

Cross-site Scripting

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Ninja Forms plugin for WordPress allows unauthenticated attackers to inject malicious scripts into a website. This occurs when a public form is submitted with specially crafted input, and these scripts can execute in an administrator's browser, potentially leading to session hijacking or unauthorized site modifications.

Attackers exploit form submissions to inject malicious code.
It impacts public-facing WordPress sites using this plugin.
Confirm relevance and assess exposure to sensitive data.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit a vulnerability in the Ninja Forms plugin by submitting a specially crafted entry through a public form. This crafted entry targets the Repeatable Fieldset feature, specifically its submission index. When an administrator later views the form submissions within the WordPress admin panel, the malicious script embedded in the submission index executes in their browser. This can lead to significant compromise of the WordPress site.

Entry requires no authentication.
Triggered by viewing form submissions.
Risk includes account takeover and site compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact WordPress sites using the Ninja Forms plugin. An unauthenticated attacker could inject malicious scripts into a form submission. These scripts may execute in an administrator's browser when they view the submission, potentially leading to unauthorized actions on the website.

Website data and administrator sessions at risk.
Exploited through crafted form submissions.
Could lead to account takeover or site defacement.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ninja Forms plugin for WordPress presents a critical risk due to an unauthenticated stored cross-site scripting vulnerability. System owners, application owners, and infrastructure teams should prioritize identifying all instances of the affected plugin. Confirming exposure to the internet, business criticality, and assigning ownership are the immediate next steps before planning remediation.

Application owners should verify plugin instances.
Confirm internet exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Ninja Forms plugin?

Ninja Forms is a popular WordPress plugin that enables site owners to create custom web forms, such as contact forms, surveys, or registration pages. It is designed to collect user input directly on a website and stores those entries in the WordPress database for administrative review.

What does CWE-79 mean for CVE-2026-65048?

CWE-79 refers to Improper Neutralization of Input During Web Page Generation, commonly known as Stored Cross-Site Scripting (XSS). In this specific CVE, the software fails to validate or sanitize malicious script inputs within the Repeatable Fieldset feature. Because the plugin displays these entries directly in the administrative dashboard without escaping the content, the saved code executes in the browser of any administrator who views the submission.

How is this vulnerability triggered?

An attacker triggers this by submitting a public form containing a crafted payload within the Repeatable Fieldset's index key. The vulnerability requires no prior authentication to the WordPress site. Importantly, simply submitting the form does not execute the script; the malicious code remains dormant until an administrator accesses the submissions page in the WordPress admin panel.

Why is this relevant to my WordPress site?

According to Halo Surface Signal, this vulnerability is highly relevant because the affected component is a public-facing form plugin. Since the plugin's primary purpose is to receive internet-based submissions, any site running vulnerable versions is inherently exposed. The attack vector leverages standard, intended functionality to reach internal administrative areas, making it a critical concern for site integrity.

What steps should I take if I use Ninja Forms?

Begin by identifying all WordPress installations where this plugin is active. Confirm which sites are accessible from the internet and evaluate their business importance. Once identified, consult the plugin developer's official resources to determine the available security updates or configuration changes needed to neutralize the threat to your administrative sessions and data.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.