Loading story…
A critical stored cross-site scripting flaw, tracked as CVE-2026-65048, was disclosed in the Ninja Forms WordPress plugin. The vulnerability affects versions 3.10.4 through 3.14.9 and stems from the plugin's Repeatable Fieldset feature, where submission indexes are accepted without numeric validation and later rendered into HTML without proper escaping. Because the vulnerable input can be submitted through a public form, the issue can be exploited by an unauthenticated attacker.
A successful attack stores malicious JavaScript in form submissions and triggers execution when an administrator reviews those submissions in the WordPress admin panel. The flaw carries a CVSS 3.1 score of 9.3 and could enable session-cookie theft, administrator account creation, malicious plugin installation, and unauthorized modification of site content. Site owners using Ninja Forms are advised to upgrade to 3.15.0 or later to remediate the issue.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A CVE entry disclosed CVE-2026-65048, a critical unauthenticated stored cross-site scripting flaw in Ninja Forms' Repeatable Fieldset feature. The issue can be triggered through crafted public form submissions and may lead to administrator compromise when submissions are viewed in the WordPress admin panel.
The WordPress plugin listing indicates Ninja Forms version 3.15.0 was published on 2026-04-24. The CVE reference states updating to 3.15.0 or later remediates the unauthenticated stored XSS vulnerability affecting versions 3.10.4 through 3.14.9.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcewordpress.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-0740**, a critical unauthenticated arbitrary file upload flaw in the **Ninja Forms File Uploads** premium add-on for WordPress that can lead to **remote code execution** and full site compromise. The vulnerability affects versions through `3.3.26` and stems from improper validation of file types and extensions in destination filenames, combined with missing filename sanitization that allows path traversal and placement of malicious PHP files in the webroot or other sensitive directories. Wordfence said it blocked more than **3,600** exploitation attempts in a 24-hour period and warned that attackers could use the bug to deploy web shells and take over vulnerable sites. Researcher **Sélim Lanouar** discovered the issue through Wordfence’s bug bounty program, and the vendor released a full fix in version `3.3.27` after an earlier partial remediation. Organizations using the add-on, which is deployed across more than **90,000** customer environments, have been urged to upgrade immediately.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-14894** affects the WordPress plugin **Super Forms – Drag & Drop Form Builder** in versions **up to and including 6.3.313**, allowing unauthenticated attackers to upload arbitrary files and potentially achieve remote code execution. The flaw stems from missing file-type validation in the plugin's `submit_form` function and the absence of a capability check on a `nopriv` AJAX handler; the required nonce can also be trivially obtained through the `super_create_nonce` `nopriv` AJAX action. The issue is classified as **CWE-434** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. The maintainer released **Super Forms 6.3.314** to address the issue by hardening file-upload handling and preventing unauthorized file writes. The patch restricts PDF generation behavior, sanitizes filenames, verifies that uploaded content begins with a PDF header, and enforces safer path handling within the upload directory, closing an attack path that could be exploited in as few as two unauthenticated HTTP requests.
Jul 10, 2026
A critical vulnerability, **CVE-2025-14533**, was disclosed in the WordPress plugin *Advanced Custom Fields: Extended* affecting versions **<= 0.9.2.1**. The issue is an **unauthenticated privilege escalation** in the plugin’s user-form handling, where the `insert_user` logic does not properly restrict which roles can be assigned during registration; as a result, an attacker can submit a registration request specifying the **`administrator`** role and obtain full administrative access under certain configurations. Reporting indicates exploitation depends on site configuration: the flaw is reachable when a form is set up such that the **`role`** value is mapped to a custom field / user role field is present in the form. The weakness was identified by **Andrea Bocchetti** via the **Wordfence Bug Bounty Program**, and is associated with **CWE-269 (Improper Privilege Management)**; once admin access is obtained, attackers can fully compromise the site (e.g., upload malicious plugins/themes, plant backdoors, or alter content for redirects).
Jun 29, 2026