CVE-2026-94504 is a stored cross-site scripting vulnerability in Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder, affecting versions up to and including 3.15.3. The vulnerability arises from improper neutralization of input during web page generation (CWE-79). Specifically, an anonymous non-RTE textarea value is stored and later rendered without safe HTML encoding in the legacy submission editor. This allows an attacker to inject script code that executes in the context of the WordPress admin origin when an administrator opens the attacker-crafted submission URL.

Successful exploitation allows an attacker to execute arbitrary script code in the context of the WordPress admin interface. This can lead to information disclosure and integrity impacts within the affected admin session. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and impacts to confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should exercise caution when opening submission URLs from untrusted sources and consider restricting access to the legacy submission editor or disabling it if possible.