CVE-2026-80437: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Ninja Forms

The Ninja Forms plugin for WordPress, specifically version 3.14.10, does not prevent execution of shortcodes embedded in request-derived input values when these values are substituted into content that is later processed for shortcodes. This improper neutralization of special elements (shortcodes) allows unauthenticated attackers to run any shortcode registered on the WordPress site, potentially leading to unauthorized actions or information disclosure. The vulnerability is identified as CWE-74 and has a CVSS v3.1 base score of 4.8, indicating medium severity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

An unauthenticated attacker can inject and execute arbitrary shortcodes on the affected WordPress site via the Ninja Forms plugin. This could lead to limited confidentiality and integrity impacts depending on the shortcodes available on the site. The CVSS score reflects low confidentiality and integrity impact with no availability impact. The exact impact depends on the shortcodes registered and their capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting access to the vulnerable plugin or disabling shortcode processing in user-submitted content if possible. Monitor official Ninja Forms channels for updates and apply any released patches promptly.