{
 "id": "WPSEC-2026-1134",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1134/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1134/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1134/index.md",
 "title": "Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via Merge Tags",
 "description": "The Ninja Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via merge tags in all versions up to, and including, 3.15.5. This is due to values substituted through merge tags, such as submitted field values, {wp:user_display_name}, user meta and post meta, being inserted into the Success Message and field default values, which are later passed to do_shortcode(), without neutralizing shortcode brackets. Submitted field values only pass through strip_shortcodes(), and that function turns an escaped tag like [[tag]] into [tag]. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting a form whose Success Message contains a field merge tag. Authenticated attackers with subscriber-level access can do the same through their own profile values on forms that use user merge tags in default values.",
 "plugin": {
  "slug": "ninja-forms",
  "name": "Ninja Forms",
  "full_name": "Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/ninja-forms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ninja-forms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ninja-forms"
 },
 "type": "UNKNOWN",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.15.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.15.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.15.6",
 "remediation": "Update to 3.15.6 or later.",
 "fix_released": "2026-10-15T18:39:01+00:00",
 "published": "2026-10-16T18:43:17+00:00",
 "updated": "2026-10-16T09:49:44.419738+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1134/",
  "https://plugins.svn.wordpress.org/ninja-forms/tags/3.15.6/",
  "https://wordpress.org/plugins/ninja-forms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ninja-forms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-16"
 }
}