{
 "id": "WPSEC-2026-1132",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1132/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1132/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1132/index.md",
 "title": "Ninja Forms <= 3.15.5 - Reflected Cross-Site Scripting via Query String Merge Tags in HTML Fields",
 "description": "The Ninja Forms plugin for WordPress is vulnerable to DOM-based Reflected Cross-Site Scripting via query string merge tags in HTML fields in all versions up to, and including, 3.15.5. This is due to the front-end script inserting the raw query string value into the HTML field content without escaping and rendering it as markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages containing a form whose HTML field combines field and query string merge tags, if they can trick a user into clicking a crafted link.",
 "plugin": {
  "slug": "ninja-forms",
  "name": "Ninja Forms",
  "full_name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/ninja-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-forms"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.15.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.15.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.15.6",
 "remediation": "Update to 3.15.6 or later.",
 "fix_released": "2026-10-15T18:39:01+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:49:44.419738+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1132/",
  "https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.6/",
  "https://wordpress.org/plugins/ninja-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}