Hippolyte Quéré

**Name of the Vulnerable Software and Affected Versions** Ninja Forms versions prior to 3.15.4 **Description** Stored Cross-Site Scripting occurs when the legacy submission editor renders an anonymous non-RTE textarea value without safe HTML encoding. This allows an attacker to inject a stored script that breaks out of the textarea. The script executes within the WordPress admin origin when an Administrator accesses a specific direct submission URL. **Recommendations** Update to a version newer than 3.15.3.