Ninja Forms 3.15.3 stores anonymous textarea values and renders them without safe HTML encoding in the legacy submission editor. A malicious user can inject a closing tag and a persistent script into the textarea, causing the script to execute in the browser context of any Administrator who opens the direct submission URL. This cross‑site scripting can lead to theft of admin credentials, session hijacking, or the execution of further malicious code under the administrator’s privileges.

The vulnerability affects the Ninja Forms plugin for WordPress, specifically version 3.15.3 and earlier, developed by kstover. The issue resides in the way textarea fields are handled within the plugin’s submission editor.

The CVSS score is 7.2, indicating a high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. The attack requires an attacker to inject script content into a textarea field (likely via normal form usage) and subsequently have an Administrator open the pre‑built submission URL. Once the admin’s browser processes the stored entry, the script runs with the administrator’s privileges. Because the vector relies on the admin opening a known URL, the likelihood of exploitation depends on attacker access to the admin and the frequency with which admins review submission URLs.