{"cvss":0.0,"datePublished":"2026-10-15T00:00:00Z","dateUpdated":"2026-10-15T00:00:00Z","description":"The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.","dueDate":"","id":"CVE-2026-92438","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"ninja_forms","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"ninjaforms ninja_forms Improper Neutralization of Input During Web Page Generation","vendor":"ninjaforms"}