Aller au contenu
en Se connecter
4.8 Moyenne

CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…

Description

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

Produits et versions touchés

Produit Versions touchées Corrigé en
Ninja Forms 3.14 3.14.10 → < 3.15.2 3.15.2

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Ninja Forms

Les 11 CVE de Ninja Forms →
CVE-2026-91827 The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when… 7.5 Élevée CVE-2026-92438 The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the… 8.8 Élevée CVE-2026-80438 The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a… 5.9 Moyenne CVE-2026-15256 The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to… 4.8 Moyenne
Suivre cette CVE