CVE-2026-109997

Name of the Vulnerable Software and Affected Versions Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder versions prior to 3.15.6

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The nf ajax submit endpoint issues a valid nonce to any requester upon failure, which neutralizes the nonce check and allows exploitation via a single unauthenticated request using the formData.extra parameter.

Recommendations Update to version 3.15.6 or later. Avoid using the formData.extra parameter in the nf ajax submit endpoint until the update is applied.