CVE Feed
6.5 Medium

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to…

CVE-2026-100155

The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

Assessment

CVSS
6.5 (v3.1)
Severity
Medium
Known exploited
Not listed in CISA KEV
Exploit availability
Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
Published
31 October 2026
Last updated
31 October 2026
Affected
kstover
Assigner
Wordfence

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

At the source

References

Query this programmatically

Agents can read this through the MCP endpoint, or over HTTP:

curl https://cve.zerocrew.in/api/cve/CVE-2026-100155