Summary
This advisory addresses CVE-2026-109997, a Stored Cross-Site Scripting vulnerability. It affects the Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress. The vulnerability is patched in version 3.15.6 and newer. There is no evidence of active exploitation.
Affected and patched versions
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (plugin ninja-forms): affected 3.15.5 and earlier; fixed in 3.15.6
Is my site vulnerable?
To determine if your WordPress site uses a vulnerable version of the Ninja Forms plugin, check the installed version. You can find this information within your WordPress administration dashboard.
Navigate to the "Plugins" section and locate "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder". The version number is displayed next to the plugin name. If the installed version is 3.15.5 or earlier, your site is vulnerable.
Alternatively, you can use WP-CLI to check the plugin version. Access your server's command line interface and execute the following command: wp plugin get ninja-forms --field=version This command outputs the currently installed version of the Ninja Forms plugin. Compare this version number against the patched version to assess your site's status.
What an attacker actually does
The Ninja Forms plugin, in versions up to and including 3.15.5, contains a Stored Cross-Site Scripting (XSS) vulnerability. This flaw exists due to insufficient input sanitization and output escaping, specifically affecting the formData.extra parameter. An attacker can use this vulnerability to inject arbitrary web scripts into pages.
The attack begins with an unauthenticated request. The nf_ajax_submit endpoint, which handles form submissions, issues a valid nonce even when a request fails. This behavior effectively neutralizes the nonce check, a security measure designed to prevent unauthorized submissions, making the exploitation of this vulnerability straightforward. With the nonce check bypassed, an attacker can send a crafted request containing malicious script code within the formData.extra parameter.
When the malicious script is successfully injected, it is stored within the site's database. Subsequently, whenever a legitimate user accesses a page that displays the stored, unsanitized form data, the injected script executes within the user's browser. This allows the attacker to perform various actions, such as stealing session cookies, redirecting users to malicious sites, defacing the website, or manipulating content displayed to the user, all from the context of the user's browser. The high severity of this vulnerability, rated with a CVSS v3 score of 7.2, reflects the potential impact of such script execution.
How to detect a compromise
Detecting a compromise related to Stored Cross-Site Scripting involves examining the site's database and content for injected scripts. Since the vulnerability affects the formData.extra parameter, the malicious script would likely reside within the stored form submission data.
Indicators of compromise may include:
Unexpected script tags (
<script>...</script>) appearing within form entries or content generated by Ninja Forms.HTML attributes containing
javascript:pseudo-protocols (e.g.,href="javascript:...") or event handlers (e.g.,onerror="alert(1)") in form data.Unusual redirects or pop-up windows when viewing form submissions or pages displaying Ninja Forms content.
To investigate, you can perform a database search for common script patterns. Access your WordPress database directly using a tool like phpMyAdmin or through WP-CLI. A WP-CLI command to search for script tags within your database could be: wp db search '<script>' --all-tables --regex This command searches all database tables for the string <script> using a regular expression. You might also broaden your search to include other common XSS payloads or attributes. Additionally, review recent form submissions within the Ninja Forms administration interface. Look for any entries that contain unusual HTML or JavaScript code in fields that correspond to the extra parameter or other text areas. Pay close attention to any submissions from unknown or suspicious IP addresses. Regularly backing up your database allows for comparison with clean versions if a compromise is suspected.
How to fix
To address CVE-2026-109997, take the following steps:
Update the Plugin: Update the Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin to version 3.15.6 or a newer patched version. This update includes the necessary input sanitization and output escaping to mitigate the vulnerability.
Log in to your WordPress administration dashboard.
Navigate to "Plugins" > "Installed Plugins".
Locate "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder".
Click the "Update Now" link if an update is available.
If no update link appears, manually check for updates or download the latest version from the WordPress plugin repository and install it.
Verify Update: After updating, confirm that the plugin version is 3.15.6 or higher.
Clear Caches: Clear any website caching (plugin caches, server-side caches, CDN caches) to ensure the updated code is served to visitors.
Review for Compromise: Even after patching, review your site for signs of compromise as described in the "How to detect a compromise" section. If malicious scripts were injected, they remain in the database until removed.
Remove Injected Scripts: If you find any injected scripts, carefully remove them from your database or form entries. Consult with a security professional if you are unsure about this process.
Timeline
Date | Event |
|---|---|
2026-09-28 | Version 3.15.5 released |
2026-10-15 | Version 3.15.6 released |
2026-10-30 | NVD Published Date |
2026-10-30 | Vulnerability Publicly Published |
2026-10-31 | Tenable Publication Date |
2026-11-01 | Tenable Update Date |