cve-2026-94504

cve-2026-94504 POC de XSS almacenado no autenticado en Ninja Forms Ninja Forms ≤ 3.15.3 — XSS almacenado no autenticado. Se guarda un textarea público sin RTE, luego se aplica htmlentitydecode y se escribe en el editor de envíos heredado sin esctextarea. 3.15.4 lo escapa. No se requiere iniciar...

CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504

Ninja Forms (WordPress plugin) 3.15.3 and earlier is vulnerable to a stored cross-site scripting (XSS) flaw in the legacy submission editor. The root cause is that an anonymous non-RTE textarea value is stored and rendered without safe HTML encoding, allowing an attacker to break out of the texta...

CVE-2026-94504: Improper Neutralization of Input During Web Page Generation

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...