CVE-2026-65048

Name of the Vulnerable Software and Affected Versions Ninja Forms versions 3.10.4 through 3.14.9

Description The Repeatable Fieldset feature contains an unauthenticated stored cross-site scripting issue. This occurs because the parseSubmissionIndex() function accepts arbitrary strings as submission indexes without numeric validation, and the admin form element() function interpolates this index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads. These scripts execute in the browser of an administrator when viewing submissions in the WordPress admin panel, potentially leading to session-cookie theft, the creation of administrator accounts, the installation of malicious plugins, and arbitrary modification of site content.

Recommendations Update Ninja Forms to a version later than 3.14.9.