CVE-2026-19769

Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.15.2

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The issue occurs via Repeater Child type Confusion through an unmatched array key. When the Ninja Forms File Uploads add-on is active, an attacker can route an unwhitelisted child entry through the File Uploads handler to write an HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root.

Recommendations Update Ninja Forms – The Contact Form Builder That Grows With You to version 3.15.2 or later. As a temporary mitigation, deactivate the Ninja Forms File Uploads add-on.