An unauthenticated attacker can inject malicious web scripts into pages generated by the Ninja Forms plugin for WordPress, which are then stored and executed…
Affected component: Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder (plugin)
Fixed in: 3.15.6
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 24, 2026. No PowerSEC firewall rule blocks this attack. Update to 3.15.6 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-110899