CVE-2026-65048 Saturday Drive CVE debrief

Who should care

WordPress administrators and users of the Ninja Forms plugin should assess their exposure and take necessary actions to mitigate this vulnerability. This includes updating to a patched version of the plugin and implementing additional security measures to protect against exploitation.

Why it matters

CVE-2026-65048 is a critical unauthenticated stored cross-site scripting vulnerability in the Ninja Forms plugin for WordPress. It allows attackers to execute malicious scripts in an administrator's browser, leading to potential session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content. WordPress administrators and users of the Ninja Forms plugin should assess their exposure and apply patches or mitigations as soon as possible.

• Session-cookie theft, enabling attackers to hijack administrator sessions.
• Creation of administrator accounts, allowing attackers to gain full control of the WordPress site.
• Installation of malicious plugins, potentially leading to further exploitation and compromise.
• Arbitrary modification of site content, impacting site integrity and user trust.

Technical summary

The Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature. The vulnerability arises from the parseSubmissionIndex() function accepting arbitrary strings as submission indexes without numeric validation, and the admin_form_element() function interpolating the index directly into HTML without escaping. An unauthenticated attacker can exploit this by submitting a public form with a crafted repeater child key containing malicious script payloads. These payloads execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.

Defensive priority

High priority for WordPress administrators and users of the Ninja Forms plugin to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the installed version of the Ninja Forms plugin is within the affected range (3.10.4 through 3.14.9).
• Apply patches or updates to the Ninja Forms plugin to version 3.14.10 or later.
• Implement additional security measures such as Content Security Policy (CSP) and input validation for user-submitted content.
• Monitor for suspicious activity, especially in the WordPress admin panel.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3 and the affected versions of the Ninja Forms plugin. However, specific details about exploitation or victim impact are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.