CVE-2026-92438 Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...

CVE-2026-92438

The Ninja Forms WordPress plugin version 3.15.3 is vulnerable to an unauthenticated stored XSS via the Paragraph Text Field . Submitted form field values are not escaped before being output on the submission edit screen in the admin area, allowing unauthenticated users to inject script through a ...

EUVD-2026-84282

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user w...

EUVD-2026-84281

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504

Ninja Forms (WordPress plugin) 3.15.3 and earlier is vulnerable to a stored cross-site scripting (XSS) flaw in the legacy submission editor. The root cause is that an anonymous non-RTE textarea value is stored and rendered without safe HTML encoding, allowing an attacker to break out of the texta...

CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

PT-2026-96652

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description Insufficient escaping of submitted form field values occurs before they are displayed on the submission edit screen within the admin area. This allows unauthenticated users to submit...

PT-2026-97007

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description Adobe Experience Manager Forms JEE contains a Server-Side Request Forgery SSRF flaw, which occurs when a server is tricked into making requests to an unintended...

CVE-2026-75744: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page...

CVE-2026-91827: Deserialization of Untrusted Data

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another install...

PT-2026-96991

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description An incorrect authorization issue allows unauthenticated attackers to execute arbitrary code in the context of the current user. This exploitation does not require a...

PT-2026-96989

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description Cross-Site Request Forgery CSRF is a flaw where a victim is tricked into performing actions they did not intend to do. This issue allows an attacker to bypass...

PT-2026-96651

Name of the Vulnerable Software and Affected Versions Ninja Forms WordPress plugin version 3.15.3 Description An issue exists where user-submitted form field values are not prevented from being deserialized when an administrator exports form submissions to CSV. This allows unauthenticated attacke...

CVE-2026-82000: Server-Side Request Forgery (SSRF)

Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal resources. Exploitation of this issue does not require user...

PT-2026-97005

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description Improper input validation allows an attacker with high privileges to execute arbitrary code in the context of the current user. This issue does not require user...

CVE-2026-81995: Improper Input Validation

Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue do...

CVE-2026-94504: Improper Neutralization of Input During Web Page Generation

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-75743: Cross-Site Request Forgery (CSRF)

Adobe Experience Manager Forms JEE is affected by a Cross-Site Request Forgery CSRF vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access, causing a limited disruption to...

PT-2026-96990

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager Forms JEE affected versions not specified Description A stored Cross-Site Scripting XSS issue exists where a high-privileged attacker can inject malicious scripts into vulnerable form fields. When a victim visits the...