The Ninja Forms WordPress plugin version 3.15.3 does not properly escape user-submitted form field values before displaying them on the submission edit screen in the admin interface. This lack of output sanitization enables unauthenticated attackers to inject malicious scripts via public forms. When a privileged user views the submission, the injected script executes in their browser, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The affected versions are >=3.15.3 and <3.15.4.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of high-privileged users' browsers, potentially leading to account compromise, data theft, or further administrative actions. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the submission edit screen to trusted users only and consider disabling public form submissions if possible to reduce exposure.