What is GHSA-pgg5-mm47-8vxf?

GHSA-pgg5-mm47-8vxf is a security advisory published by GitHub Security Advisories with Medium severity. The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in...

Which CVE IDs does GHSA-pgg5-mm47-8vxf cover?

GHSA-pgg5-mm47-8vxf covers the following CVE IDs: CVE-2026-80437. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pgg5-mm47-8vxf?

GHSA-pgg5-mm47-8vxf has a CVSS v3 base score of 4.8, published by GitHub Security Advisories.

GHSA-pgg5-mm47-8vxfMediumCVSS 4.8

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in...

Vendor

GitHub Security Advisories

Published

September 6, 2026

Last Modified

September 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-80437 →

📋 Description

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-80437
https://wpscan.com/vulnerability/473a3321-7dc6-454a-82f4-89b6a393d09a
https://github.com/advisories/GHSA-pgg5-mm47-8vxf