CVE-2026-90438

HighCVSS 7.2/10Last modified Oct 3, 2026

Description

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 2, 2026
Last modified: Oct 3, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-904396.5NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3 CVE-2026-90448.0An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authentic CVE-2026-904408.2Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.n CVE-2026-904418.1A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil CVE-2026-904435.4A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no CVE-2026-904448.8A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An CVE-2026-904456.5An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted CVE-2026-904464.3An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request CVE-2026-904476.5A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli CVE-2026-904486.5A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr CVE-2026-904496.5When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface CVE-2026-90457.8During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise fo