A newly tracked flaw, CVE-2026-100155, hits the widely used Ninja Forms plugin for WordPress, affecting every release through version 3.15.5. The bug stems from an action that fails to validate a value before passing it to do_shortcode, and because the check is missing entirely, even attackers with no account can trigger it. In practice that lets an outsider run arbitrary WordPress shortcodes on a vulnerable site, which can be abused depending on which other plugins are installed.
// source: nvd.nist.gov ↗