CVE-2026-80437 The Ninja Forms WordPress plugin from 3.14.10 before… — CVE Notify

CVE Notify@cveNotify · 19.7K subscribers Open in TelegramOpen

🚨 CVE-2026-80437
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

🎖@cveNotify

WPScan

Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

See details on Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags CVE 2026-80437. View the latest Plugin Vulnerabilities on WPScan.