CVE-2026-110899: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Kevin Stover Ninja Forms

The vulnerability CVE-2026-110899 in Kevin Stover Ninja Forms is a stored cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This allows attackers to inject malicious scripts that are stored and later executed in the context of users viewing the affected pages. The affected versions include all releases from initial versions up to 3.15.5. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this stored XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of users interacting with the Ninja Forms plugin. This can lead to information disclosure, session hijacking, or other impacts on confidentiality, integrity, and availability as indicated by the CVSS vector. There is no information about known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting exposure to untrusted input and applying any recommended temporary mitigations from the vendor. Monitor the vendor's channels for updates regarding patches or official fixes.