CVE-2026-101326

Name of the Vulnerable Software and Affected Versions Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder versions prior to 3.15.6

Description Authenticated users with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate a value before executing the do shortcode() function. Exploitation is possible if an administrator configures a Ninja Forms field with its Default Value set to the {wp:user display name} merge tag on a publicly accessible page, allowing a subscriber to set their display name to a shortcode string via their profile and trigger the execution by visiting that page.

Recommendations Update to version 3.15.6 or later.