CVE-2026-19769: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in kstover Ninja Forms – The Contact Form Builder That Grows With You

CVE-2026-19769 describes a stored cross-site scripting vulnerability in the Ninja Forms WordPress plugin (versions <=3.15.1). The flaw arises from improper neutralization of input during web page generation, specifically via a repeater child 'type' confusion caused by unmatched array keys. Attackers can exploit this by leveraging the Ninja Forms File Uploads add-on to write attacker-controlled HTML files containing arbitrary JavaScript into any directory writable by the web server, including the root directory. These scripts execute in the context of the site origin when accessed by users, enabling potential compromise of user sessions or data.

The vulnerability allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of the affected website. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of users visiting the compromised pages. The attack requires the File Uploads add-on to be active, which facilitates writing malicious HTML files to the server. The CVSS 3.1 score of 7.2 reflects a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

No official patch or fix information is provided in the vendor advisory or patch links. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the Ninja Forms File Uploads add-on if not needed, as exploitation requires this component. Monitor vendor channels for updates and apply official patches promptly once released.