Skip to content
fr Sign in
4.8 Medium

CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…

Description

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

Affected products and versions

Product Affected versions Fixed in
Ninja Forms 3.14 3.14.10 → < 3.15.2 3.15.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Ninja Forms

The 11 CVEs of Ninja Forms →
CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when… 7.5 High CVE-2026-92438 The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the… 8.8 High CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a… 5.9 Medium CVE-2026-15256 The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to… 4.8 Medium
Track this CVE