4.8
Medium
CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…
Description
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ninja Forms 3.14 | 3.14.10 → < 3.15.2 | 3.15.2 |
Other CVEs of Ninja Forms
The 11 CVEs of Ninja Forms →
CVE-2026-91827
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when…
7.5
High
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the…
8.8
High
CVE-2026-80438
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a…
5.9
Medium
CVE-2026-15256
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to…
4.8
Medium