Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-100155

Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub

Summary

The Ninja Forms contact form plugin for WordPress is affected by this vulnerability. It could allow someone without logging in to run arbitrary WordPress shortcodes on a site, potentially exposing data or performing actions the site owner did not intend.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

    through 3.15.5

References 9

wordfence.com

plugins.trac.wordpress.org

wordpress.org