CVE-2026-15161 is a stored cross-site scripting vulnerability in the Ninja Forms - Excel Export WordPress plugin. The issue occurs because the save_filter() AJAX handler saves the raw $_POST['filter'] array into a WordPress option via update_option() without any capability checks, nonce verification, or input sanitization. Subsequently, the get_filter_row() method outputs the stored filter values directly into HTML attributes without using esc_attr() for escaping. This combination allows an authenticated attacker with subscriber-level or higher privileges to inject arbitrary JavaScript that executes in the context of users viewing the injected page, potentially leading to session hijacking or other script-based attacks.

An attacker with subscriber-level or higher access can inject malicious scripts that execute in the browsers of users who view the affected pages. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not affect availability but impacts confidentiality and integrity of user sessions and data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and consider disabling the Excel Export functionality if feasible. Monitor official SaturdayDrive or Ninja Forms channels for updates or patches addressing this vulnerability.