CVE-2026-101326

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-101326 Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properl...

CVE-2026-101326

The Ninja Forms WordPress plugin (versions up to and including 3.15.5 ) is vulnerable to arbitrary shortcode execution . The root cause is insufficient validation of values before they are processed by the do_shortcode function. Specifically, an authenticated attacker with Subscriber-level access...