VulnSocial

CVE-2026-92438Patch

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-09-22); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-09-22: 2Mentions · 2026-09-28: 1Patch / Workaround · 2026-09-22: 1Patch / Workaround · 2026-09-28: 1Technical Details · 2026-09-22: 1Technical Details · 2026-09-28: 109-2209-28
Signal classification2 categories
Patch
266.7%
General
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-09-222
General1Patch1
2026-09-281
Patch1
Full discourse3 posts
  • Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters
    Patch

    CVE-2026-92438: Ninja Forms WordPress plugin 3.15.3 stored XSS via unescaped form fields. Unauthenticated attackers can run code in an admin's browser. CVSS 8.8, no patch yet. Update or disable immediately. https://www.valtersit.com/cve/CVE-2026-92438 #CVE #WordPress #infosec #NinjaForms #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker

    Post summary

    The text announces a stored XSS vulnerability in the Ninja Forms WordPress plugin (CVE-2026-92438) with a CVSS score of 8.8, emphasizing that no patch is available yet but advising users to update or disable the plugin as an immediate workaround.

    0002050
    1.0K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 WordPress Ninja Forms eklentisinde yüksek önem dereceli Stored XSS açığı: CVE-2026-92438 Ninja Forms 3.15.3 sürümünü etkileyen açık, kimlik doğrulaması gerektirmiyor ve CVSS 8.8 (High) olarak değerlendiriliyor. Açık, herkese açık formlardaki Paragraph Text Field alanına gönderilen verilerin yönetim panelindeki submission düzenleme ekranında yeterince escape edilmemesinden kaynaklanıyor. Saldırgan, hazırladığı veriyi forma göndererek submission'a kaydedebiliyor. Yüksek ayrıcalıklı bir kullanıcı bu submission'ı görüntülediğinde XSS kodu çalışabiliyor. Etkilenen sürüm: 3.15.3 Düzeltilen sürüm: 3.15.4 ve üzeri WordPress sitelerinde Ninja Forms kullananların sürümlerini kontrol ederek güncelleme yapması gerekiyor. https://wordpress.org/plugins/ninja-forms/

    Post summary

    The text discloses CVE-2026-92438, a stored XSS flaw in Ninja Forms 3.15.3 with CVSS 8.8, and explicitly recommends updating to version 3.15.4 or above as mitigation.

    00020186
    2.4K followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en Complementos de WordPress ❗ CVE-2026-93485 ❗ CVE-2026-92438 ❗ CVE-2026-19658 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-complementos-de-wordpress-4/ https://t.co/xvy0fej6ZD

    Post summary

    The tweet announces three CVEs affecting WordPress plugins (CVE-2026-93485, CVE-2026-92438, CVE-2026-19658) and provides links for more information.

    00000248
    6.7K followersView on X

Explore more

Back to dashboard