CVE-2026-67187

The record

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.

Affected packages

Related vulnerabilities

• CVE-2026-102799 Joomla Extension - icagenda.com - CSV formula injection in the registrations export in… CWE-1236
• CVE-2026-116647 Tanium addressed an improper output sanitization vulnerability in Comply. CWE-1236
• CVE-2026-116649 Tanium addressed an improper output sanitization vulnerability in Enforce. CWE-1236
• CVE-2026-86020 Part-DB is an open source inventory management system for electronic components. CWE-1236
• CVE-2026-89246 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV… CWE-1236
• CVE-2026-86257 wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV… CWE-1236
• CVE-2026-9852 A CSV injection vulnerability exists in SYS600. CWE-1236
• CVE-2026-56652 Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when… CWE-1236