CVE-2026-65048 is a critical stored cross-site scripting vulnerability in the Ninja Forms WordPress plugin by Saturday Drive, affecting versions 3.10.4 through 3.14.9. The flaw exists in the Repeatable Fieldset feature where parseSubmissionIndex() does not validate that submission indexes are numeric, allowing arbitrary strings. These strings are then directly interpolated into HTML by admin_form_element() without proper escaping. An unauthenticated attacker can submit a specially crafted repeater child key containing malicious JavaScript payloads. When an administrator views the affected submissions in the WordPress admin panel, the payload executes in their browser, enabling severe impacts such as session-cookie theft, creation of admin accounts, installation of malicious plugins, and arbitrary modification of site content.

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser session. This can lead to theft of session cookies, enabling account takeover, unauthorized creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content. The impact is critical due to the potential for full site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin panel to trusted users only and consider disabling or restricting the use of the Repeatable Fieldset feature in Ninja Forms. Monitor vendor channels for updates and apply patches promptly once released.