CVE-2026-94504

🗓️ 22 Sep 2026 06:39:41Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Ninja Forms up to 3.15.3 stored XSS in legacy submission editor via unencoded textarea value.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2026-94504	24 Sep 202601:07	–	githubexploit
Circl	CVE-2026-94504	22 Sep 202607:44	–	circl
Cvelist	CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting	22 Sep 202606:39	–	cvelist
EUVD	EUVD-2026-84281	22 Sep 202606:39	–	euvd
Kitploit	cve-2026-94504	24 Sep 202615:38	–	kitploit
NVD	CVE-2026-94504	22 Sep 202607:16	–	nvd
Patchstack	WordPress Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin <= 3.15.3 - Stored Cross-Site Scripting vulnerability	22 Sep 202613:33	–	patchstack
Positive Technologies	PT-2026-96653	22 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-94504: Improper Neutralization of Input During Web Page Generation	22 Sep 202600:00	–	rapid7
VulnCheck KEV	VulnCheck KEV: CVE-2026-94504	6 Oct 202600:00	–	vulncheck_kev

Vulners

Node

ninjaforms ninja_formsRange≤3.15.3wordpress

[
  {
    "vendor": "kstover",
    "product": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.15.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Fields/Textarea.php
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Templates/admin-metabox-sub-fields.html.php
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Fields/Textarea.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c599a562-5218-4b37-bcf7-0e82008a4e68
plugins	www.plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Database/Models/Submission.php
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
textarea	request body	/wp-admin/admin-ajax.php	Unauthenticated nf_ajax_submit path allowing stored XSS via a non-RTE textarea payload that is saved and later executed when an admin opens the submission.	CWE-79
post_content	path	/wp-admin/post.php?post=ID&action=edit	Opening the submission edit page loads the stored attacker payload and executes it in the admin context.	CWE-79

22 Sep 2026 19:04Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.2

EPSS0.00412

SSVC