CVE-2026-90438 kstover CVE debrief

Who should care

Defenders responsible for WordPress installations with the Ninja Forms plugin, particularly versions up to and including 3.15.4, should assess exposure to potential cross-site scripting attacks and prioritize verification and mitigation efforts.

Why it matters

The CVE-2026-90438 vulnerability in the Ninja Forms plugin for WordPress allows for stored cross-site scripting via paragraph text field submissions, which can lead to arbitrary web script injection. Defenders must verify the presence of the plugin, assess exposure, and prioritize patching or mitigation to prevent exploitation.

• Defenders must verify the presence of the Ninja Forms plugin in their WordPress installations and assess exposure to potential cross-site scripting attacks.
• The vulnerability allows for stored cross-site scripting via paragraph text field submissions, which can lead to arbitrary web script injection.
• The Rich Text Editor (RTE) option must be enabled for exploitation to be possible, limiting the attack surface.
• Immediate action is required to apply patches or mitigations to prevent exploitation of the vulnerability.

Technical summary

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of the Ninja Forms plugin, particularly versions up to and including 3.15.4, to potential cross-site scripting attacks. Immediate action is required to apply patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify the presence of the Ninja Forms plugin in your WordPress installation and assess exposure to potential cross-site scripting attacks.
• Check if the Rich Text Editor (RTE) option is enabled for paragraph text fields in the Ninja Forms plugin.
• Apply patches or mitigations to prevent exploitation of the vulnerability.
• Monitor for potential cross-site scripting attacks targeting the Ninja Forms plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in the Ninja Forms plugin. The vulnerability allows for stored cross-site scripting via paragraph text field submissions. The Rich Text Editor (RTE) option must be enabled for exploitation to be possible. The CVE record was published on 2026-10-02T06:16:42.050Z and last modified on 2026-10-03T16:16:41.097Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.