CVE-2026-94504

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.15.4

Description Stored Cross-Site Scripting occurs when the legacy submission editor renders an anonymous non-RTE textarea value without safe HTML encoding. This allows an attacker to inject a stored script that breaks out of the textarea. The script executes within the WordPress admin origin when an Administrator accesses a specific direct submission URL.

Recommendations Update to a version newer than 3.15.3.