Dashboard / CVE-2026-100155

CVE-2026-100155

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 73/100
Published: 2026-10-31 Modified: 2026-10-31 First seen: 2026-10-31 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder 0

References & Advisories (9)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.51%
Raw Score 0.005140
Percentile 43.8%
Date 2026-10-31

Intelligence Sources

mitre ref →
nvd ref →

External Links