CVE-2026-65048: critical vulnerability in Saturday Drive Ninja Forms
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.3epss 0.5%
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
Saturday Drive · Ninja FormsRelated CVEs — Saturday Drive Ninja Forms
In the same product, most dangerous first.
CVE-2021-34647MEDIUMNinja Forms <= 3.5.7 Sensitive Information DisclosureEPSS 1.2%CVE-2021-34648MEDIUMNinja Forms <= 3.5.7 Unprotected REST-API to Email InjectionEPSS 0.7%CVE-2026-65052HIGHNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsEPSS 0.6%CVE-2023-38393HIGHWordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-26019MEDIUMCVE-2024-26019EPSS 0.5%CVE-2023-38386HIGHWordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerabilityEPSS 0.5%