EUVD-2026-91177

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-90438 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-90438

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.15.4 . The root cause is insufficient input sanitization and output escaping within the Paragraph Text (RTE) Field Submission. This allows unauthenticated attackers to inj...

CVE-2026-90438 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-90438: Improper Neutralization of Input During Web Page Generation

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-104081

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.15.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping during Paragraph Text field submissions...

WordPress Ninja Forms plugin <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission vulnerability

Unauthenticated Stored Cross-Site Scripting via Paragraph Text RTE Field Submission vulnerability discovered by UKO - Korea univ. in WordPress Plugin Ninja Forms versions = 3.15.4...