Unauthenticated attackers can inject arbitrary web scripts into pages via the 'formData.extra' parameter in Ninja Forms, which execute when a user accesses an…
Affected component: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (plugin)
Fixed in: 3.15.6
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since November 3, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.15.6 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-109997