CVE-2026-19769

The Ninja Forms contact form plugin for WordPress, in all versions up to and including 3.15.1, fails to adequately sanitize and escape a Repeater field's child 'type' value, letting an unwhitelisted array key pass through as a 'type confusion'. An unauthenticated attacker submits a crafted form submission that routes this unwhitelisted child entry through the File Uploads add-on handler, which writes an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root. Because the file is served from the site's own origin, the injected web script executes whenever a user accesses the injected page, allowing script injection in visitors' browsers. Only sites running Ninja Forms up to 3.15.1 with the File Uploads add-on active are exploitable. There is currently no known exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV, with a low EPSS probability of exploitation in the next 30 days.

What to do: Update Ninja Forms to the first release newer than 3.15.1 as soon as a patched version is published; no fixed version number is confirmed in the available data. Sites that cannot patch immediately should deactivate the Ninja Forms File Uploads add-on, since exploitation requires it, and check web-writable directories (including the site root and uploads folders) for unexpected or recently written HTML files that could contain injected scripts.