The vulnerability arises from a mismatch of array keys in Ninja Forms 3.15.1 and earlier, which causes the Repeater Child 'type' field to be misinterpreted. This mistake bypasses the plugin’s sanitization and allows an unauthenticated attacker to inject arbitrary JavaScript into an HTML file. The stored script is then served from the site’s own origin, enabling defacement, cookie theft, or redirect to malicious sites. The flaw requires the Ninja Forms File Uploads add‑on to be active, as it routes the unvalidated data to the file‑upload handler that writes the malicious payload into any web‑writable directory, including the site root.

The issue affects all releases of the Ninja Forms WordPress contact form builder up to and including version 3.15.1 where the File Uploads add‑on is enabled. Disabled File Uploads or versions newer than 3.15.1 are not impacted.

The CVSS score of 7.2 places the issue in the high‑severity range. The vulnerability is not catalogued in the CISA KEV, and EPSS information is currently unavailable; however, the lack of an authentication requirement and the need for only the File Uploads component suggest that it could be widely exploitable. An attacker can submit a form from any IP address, causing a script that will run for any visitor to the affected page. Sites that expose the File Uploads add‑on or deploy Ninja Forms in default writable directories face the highest risk.