CVE-2026-15256 is an injection vulnerability (CWE-74) in the Ninja Forms WordPress plugin prior to version 3.14.10. The flaw arises from improper neutralization of special elements in output used by a downstream component. Specifically, user-supplied query-string input intended to pre-populate form fields is processed as a shortcode, which can be exploited by unauthenticated attackers to execute arbitrary shortcodes registered on the site when the affected form is embedded on a public page.

An attacker can execute arbitrary shortcodes on the affected WordPress site without authentication, potentially leading to limited confidentiality and integrity impacts. The CVSS score of 4.8 (medium severity) reflects that the attack vector is network-based, requires high attack complexity, no privileges or user interaction, and impacts confidentiality and integrity to a limited extent. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid embedding vulnerable Ninja Forms that pre-populate fields from user-supplied query strings or restrict access to such forms. Monitor vendor channels for updates and apply official patches once released.