CVE-2026-65048 is a critical unauthenticated stored cross-site scripting vulnerability in the Ninja Forms WordPress plugin by Saturday Drive, affecting versions 3.10.4 through 3.14.9. The vulnerability exists in the Repeatable Fieldset feature where the function parseSubmissionIndex() does not enforce numeric validation on submission indexes, allowing arbitrary strings. These strings are then directly interpolated into HTML by admin_form_element() without proper escaping. An attacker can submit a specially crafted repeater child key containing malicious JavaScript payloads via a public form. When an administrator views the affected submissions in the WordPress admin panel, the malicious script executes in their browser context. This enables severe impacts including session cookie theft, unauthorized administrator account creation, malicious plugin installation, and arbitrary modification of site content.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator's browser. This can lead to theft of session cookies, enabling account takeover, creation of new administrator accounts, installation of malicious plugins, and unauthorized modification of website content. The vulnerability thus compromises the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the WordPress admin panel and monitor for suspicious form submissions. Avoid viewing untrusted form submissions in the admin interface. Follow the vendor's updates closely for an official patch or mitigation instructions.