CVE-2026-65048— Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
Quick assessment
Affected
Saturday Drive Ninja Forms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress Ninja Forms是WordPress基金会的一款信息化产品。 WordPress Ninja Forms 3.10.4版本至3.14.9版本存在跨站脚本漏洞，该漏洞源于Repeatable Fieldset功能中parseSubmissionIndex()接受任意字符串作为提交索引而未进行数字验证，且admin_form_element()将索引直接插入HTML而未转义，可能导致未经身份验证的攻击者提交带有恶意脚本有效载荷的恶意重复子键，在管理员查看WordPress后台提交时执
Possible ATT&CK Techniques 3 AI
T1059.007 · JavaScript T1078.004 · Cloud Accounts T1189 · Drive-by CompromiseAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Saturday Drive | Ninja Forms | 3.10.4< 3.14.9 |
affected |
3.14.9 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-65048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
Source: CVE Program / CVE List V5
Vulnerability Description
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Ninja Forms 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Ninja Forms是WordPress基金会的一款信息化产品。 WordPress Ninja Forms 3.10.4版本至3.14.9版本存在跨站脚本漏洞，该漏洞源于Repeatable Fieldset功能中parseSubmissionIndex()接受任意字符串作为提交索引而未进行数字验证，且admin_form_element()将索引直接插入HTML而未转义，可能导致未经身份验证的攻击者提交带有恶意脚本有效载荷的恶意重复子键，在管理员查看WordPress后台提交时执
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Saturday Drive | Ninja Forms | 3.10.4 ~ 3.14.9 | - |
|
II. Public POCs for CVE-2026-65048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-65048
请登录查看更多情报信息。
News Coverage for CVE-2026-65048 (1)
Vendor Pages for CVE-2026-65048 (1)
Same Patch Batch · Saturday Drive · 2026-07-21 · 5 CVEs total
| CVE-2026-65049 | 9.3 CRITICAL | Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all |
| CVE-2026-65052 | 7.5 HIGH | Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSe |
| CVE-2026-65051 | 6.5 MEDIUM | Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJ |
| CVE-2026-65050 | 6.5 MEDIUM | Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Subm |
IV. Related Vulnerabilities
Same product: Ninja Forms
-
CVE-2026-92438
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragrap -
CVE-2026-91827
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection vi -
CVE-2026-80437
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Sho -
CVE-2026-80438
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post M -
CVE-2026-15256
Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode
Same vendor: Saturday Drive
-
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Su -
CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorizatio -
CVE-2026-81773
WordPress Ninja Forms File Uploads Extension plugin <= 3.3.2 -
CVE-2026-81772
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - P -
CVE-2026-65052
Ninja Forms Calculation and Payment Total Tampering via Fail
Same weakness: CWE-79
-
CVE-2026-77912
Stored cross-site scripting vulnerability in GitHub Enterpri -
CVE-2026-88020
Improper Neutralization of Input During Web Page Generation -
CVE-2026-95812
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Para -
CVE-2026-76909
Unleash: CR-approval email renders user-controlled raw HTML -
CVE-2026-83801
Nautobot: Stored cross-site scripting (XSS) in object create
V. Comments for CVE-2026-65048
No comments yet