Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-90438 · Microsoft / collected KEV context

cve-program · CVE-2026-90438

• https://www.wordfence.com/threat-intel/vulnerabilities/id/a159485d-ce5b-46e7-8e63-a72012ccc180?source=cve
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/build/submissions.js#L1
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Helper.php#L261
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/Database/Models/Submission.php#L308
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.3/includes/AJAX/Controllers/Submission.php#L61
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.2/build/submissions.js#L1
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.2/includes/Helper.php#L261
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.2/includes/Database/Models/Submission.php#L308
• https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.2/includes/AJAX/Controllers/Submission.php#L61
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3717122%40ninja-forms%2Ftags%2F3.15.5&old=3705719%40ninja-forms%2Ftags%2F3.15.4
• https://plugins.trac.wordpress.org/changeset/3717122/ninja-forms/trunk/includes/AJAX/Controllers/Submission.php

No related operational record is retained in the current change model.