Description

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T07:17:11.333Z",
  "pubdate": "2026-09-05T07:17:11.333Z",
  "executiveSummary": "The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.15.1.\nThe flaw originates from improper input sanitization and output escaping within the Repeater Child functionality, allowing for type confusion through unmatched array keys.\nSuccessful exploitation permits unauthenticated attackers to inject arbitrary JavaScript, which executes within the context of a victim's browser when they access affected pages.\nThe vulnerability is dependent on the activation of the Ninja Forms File Uploads add-on, which acts as a vector to write malicious HTML content directly to the web server's file system.\nBy bypassing whitelist restrictions, attackers can place scripts in server-writable directories, including the site root, causing the payloads to be served from the site's own origin.\nThis creates a critical security risk where attackers can execute unauthorized scripts, potentially leading to session hijacking, unauthorized actions, or site compromise.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting (XSS) condition facilitated by type confusion in the plugin's Repeater Child logic. The root cause lies in the application's failure to adequately sanitize input or escape output during the processing of Repeater Child entries.\nSpecifically, the plugin fails to handle unmatched array keys correctly, leading to a type confusion scenario when handling child 'type' attributes. This flaw allows an attacker to manipulate the input payload to circumvent security validations.\nThe attack vector necessitates that the Ninja Forms File Uploads add-on be active. When an attacker sends a crafted request, the payload leverages the File Uploads handler to process a malicious file entry. Because the handler does not strictly validate the 'type' of the child entry, the attacker can submit a payload that is subsequently treated as a legitimate file upload.\nThe exploit flow proceeds as follows: First, the attacker identifies a form using the Repeater feature. Second, the attacker crafts a malicious POST request containing an unmatched array key that triggers the type confusion logic. Third, the plugin's File Uploads handler, misled by the manipulated type attribute, processes this input as a file. Fourth, the server writes the attacker-supplied HTML content—containing arbitrary JavaScript—into a web-server-writable directory. This can include sensitive locations like the site root.\nBecause the file is written to the server's directory, it is served directly from the application's origin. When a user navigates to the URL where the malicious file is hosted, or when the injected script is rendered in a page context, the browser executes the attacker's JavaScript code. This bypasses typical cross-origin protections because the script appears to originate from the trusted domain.\nThe scope of impact is significant, as the exploitation does not require prior authentication, allowing any remote user to inject code. Post-exploitation, an attacker can perform actions on behalf of the user, steal session cookies, capture administrative inputs, or redirect users to malicious domains, effectively resulting in full client-side control within the context of the WordPress site."
}