# CVE-2026-100151: CVE-2026-100151

Status: published. Published: 2026-10-31. Updated: 2026-11-01.

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This bypass is triggered when an attacker supplies a matching field:&lt;key&gt; URL parameter that causes the server to fully resolve the {field:*} placeholder, forcing the client-side else-branch to abandon the server-sanitized value and reconstruct field content from the raw query string.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 6.1 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; source: NVD: security@wordfence.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable no; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-79

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/assets/js/min/front-end.js (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/MergeTags/Other.php#L41 (security@wordfence.com)

- https://plugins.trac.wordpress.org/browser/ninja-forms/tags/3.15.4/includes/Templates/fields-html.html#L2 (security@wordfence.com)

- https://plugins.trac.wordpress.org/changeset/3749135/ninja-forms/trunk/assets/js/min/front-end.js (security@wordfence.com)

- https://wordpress.org/plugins/ninja-forms/ (security@wordfence.com)

- https://www.wordfence.com/threat-intel/vulnerabilities/id/82ace2e3-1120-4be9-a7c6-b64590c8a35f?source=cve (security@wordfence.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100151; retrieved 2026-11-02; source updated 2026-11-01

Revision: da60d8962b72114aa310c83c96a3b1ab3e3024ec068842766599c93f4c496a46

Canonical: https://y2.dev/cve/CVE-2026-100151