CVE-2026-92438

8.8 Élevée

Publiée le 22/09/2026 à 09:16 · Modifiée le 22/09/2026 à 21:41 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.

Traduire en français

Produits concernés

Unknown Ninja Forms

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	contact@wpscan.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/eeed1378-2c51-4d38-9dda-4a13ce330b25/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories