Unauthenticated XSS Vulnerability in Ninja Forms WordPress Plugin (CVE-2026-102385)

What Happened

A Cross-Site Scripting (XSS) vulnerability was identified in the Ninja Forms WordPress plugin, affecting versions up to and including 3.15.3. The issue is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It was published on September 30, 2026, and is tracked as CVE-2026-102385.

Technical Cause

The vulnerability is an Unauthenticated Cross-Site Scripting (XSS) flaw. According to the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the attack can be carried out remotely over the network, requires low attack complexity, and does not require any privileges on the target system. However, it does require user interaction, meaning a victim would need to be lured into performing some action, such as clicking a malicious link, for the attack to succeed. No further technical detail about the specific injection point or affected form functionality was provided in the source material.

Why It Matters

Cross-Site Scripting vulnerabilities allow attackers to inject malicious scripts that execute in the context of a victim's browser session. Because this flaw can be triggered without authentication, any visitor to a vulnerable site could potentially be targeted, provided they are induced to interact with a malicious element. The CVSS score of 7.1 reflects a scope change (S:C), meaning the impact may extend beyond the vulnerable component itself, alongside limited confidentiality, integrity, and availability impacts (each rated Low).

Who Is Affected

Any WordPress site running the Ninja Forms plugin at version 3.15.3 or earlier is potentially affected. Ninja Forms is a popular plugin used for building contact forms, calculators, quizzes, and other interactive forms on WordPress sites, with an estimated install base in the hundreds of thousands.

Affected Versions

Versions of Ninja Forms up to and including 3.15.3 are documented as affected. Source material references 3.15.5 as the version after which the issue is addressed in the advisory title, but PatchBriefing has not been able to independently confirm the availability or contents of a fix at this time.

Fixes and Mitigation

The fact package marks this advisory as 'fix not confirmed available' (fix_available: false), despite the advisory title referencing version 3.15.5. PatchBriefing cannot confirm with certainty whether a patched release exists or what changes it may contain. Site owners should monitor the official Ninja Forms plugin changelog and the WordPress.org plugin repository for updates and verify the current installed version against any future confirmed fixed release.

Recommended Action

Site administrators running Ninja Forms should check their currently installed version and compare it against the latest version available through the WordPress plugin repository. Until a confirmed fixed version is verified, consider reviewing form-related input handling, restricting untrusted user interactions where possible, and monitoring for unusual activity related to form submissions.