CVE-2026-65048Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
3 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 1 classified signal
Peaked at 2 mentions on most recent observed day (2026-07-23)
3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d

Signal classification2 categories

Patch

266.7%

Disclosure

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	1	Disclosure1
2026-07-23	2	Patch2

Full discourse3 posts

Daily CyberSecurity@Daily_CyberSec90d
Patch
A Ninja Forms vulnerability chain hits 600K+ sites. CVE-2026-65048 is an unauthenticated stored XSS rated CVSS 9.3. Update to 3.14.10 now. #NinjaForms #WordPress #StoredXSS #CVE202665048 #PluginSecurity #InfoSec http://securityonline.info/ninja-forms-vulnerability-cve-2026-65048/
Post summary
An unauthenticated stored XSS vulnerability (CVE-2026-65048) in Ninja Forms has been disclosed with a CVSS score of 9.3; users are advised to update to version 3.14.10 to remediate the issue.
06062527
12.9K followersView on X
kokumօtօ@__kokumoto90d
Patch
60万サイト以上が使用するWordPressのNinja Formsプラグインに重大(Critical)な脆弱性。CVE-2026-65048はそれぞれCVSSスコア9.3の蓄積型クロスサイトスクリプティング。その他脆弱性3件と併せ修正。 https://securityonline.info/ninja-forms-vulnerability-cve-2026-65048/
Post summary
CVE‑2026‑65048 is a critical stored‑XSS flaw in WordPress Ninja Forms with a CVSS score of 9.3, which has been addressed by a patch that also covers three additional vulnerabilities.
01043815
7.8K followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨 CRITICAL - Unauthenticated Stored XSS via Repeatable Fieldset submission index (CVE-2026-65048) Ninja Forms for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) in the Repeatable Fieldset feature, where a crafted repeater child key is stored and later rendered in wp-admin when viewing form submissions. The root cause is improper input validation (missing numeric validation) combined with lack of HTML escaping on a submission index value. An attacker exploits this by submitting a public-facing form with a malicious repeater child key—no authentication required—then waiting for an administrator to review submissions in the WordPress dashboard. Impact includes admin session hijack/cookie theft and full site takeover actions such as creating admin users, installing malicious plugins, and altering site content. 👉 Affected: ninja-forms (WordPress plugin) 3.10.4–3.14.9 | Upgrade to 3.14.10+
Post summary
CVE-2026-65048 allows unauthenticated stored XSS via Ninja Forms' Repeatable Fieldset, enabling attackers to hijack admin sessions and take over the site; the issue is mitigated by upgrading to version 3.14.10 or later.
0101079
255 followersView on X

Explore more

Back to dashboard