The Ninja Forms plugin for WordPress is vulnerable to stored cross‑site scripting caused by a templating engine that fails to escape user‑supplied data. When an authenticated user with contributor or higher privileges injects a script into a template or form, the malicious code is stored and will execute in the browsers of any visitor who loads the affected page. This flaw is identified as CWE‑79 and can lead to session hijacking, defacement, or other client‑side compromise.

Ninja Forms for WordPress, all releases up to and including 3.10.2.1.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1 percent shows a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated contributor (or higher) with the ability to edit templates or form content; once an attacker injects script, any user who accesses the page will have the code executed. Overall risk is moderate, with a limited attack surface owing to the authentication requirement.