CVE-2026-65048

The Ninja Forms plugin for WordPress, in versions 3.10.4 through 3.14.9, has a security flaw that allows attackers to inject malicious code into the WordPress admin panel. This is possible because the plugin doesn't properly validate the submission indexes, allowing an attacker to insert malicious scripts that can be executed when an administrator views the form submissions. As a result, an attacker can potentially steal session cookies, create new administrator accounts, install malicious plugins, or modify site content.

Based on public CVE data (MITRE/NVD).