Risk Letters

Exploited vulnerability

CVE-2026-94504

TLP:CLEAR

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.

Facts

  • Vendor: kstover
  • Product: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
  • EPSS (probability of exploitation within 30 days): 0.6 %
  • First known exploitation: 6 October 2026
  • First seen by Risk Letters: 6 October 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD