Threat intelligence dashboard
CVE-2026-100155medium

Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Risk score

6.5

CVSS 3.1

Vendor
kstover
Product
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
CWE
CWE-94
Published
Oct 31, 2026
Updated
Oct 31, 2026
CISA KEV
Not flagged

Affected products and versions

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

kstover

Version / rangeStatusType
0 to 3.15.5affectedsemver

Technical metrics

6.5

CVSS 3.1

Severity
medium
Source
Wordfence
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N