Jakub Herman found the same ordering mistake in three unrelated WordPress form plugins, WPScan’s records for all three reached NVD on September 6, 2026, and the proof-of-concepts are scheduled to publish on September 16 and 17.
What happened
Three CVE records published to NVD within ninety seconds of each other on September 6, 2026, all with WPScan as the assigning CNA under [email protected], all classified CWE-74, and all credited to the same researcher, Jakub Herman. Each describes an unauthenticated visitor getting a WordPress site to execute shortcodes of the attacker’s choosing. The underlying WPScan advisories are dated September 3, 2026 for two of them and September 4, 2026 for the third; the CVE identifiers and NVD records are what is new today.
CVE-2026-19859 covers JetFormBuilder before 3.6.5.2. WPScan titles it “JetFormBuilder < 3.6.5.2 – Unauthenticated Arbitrary Shortcode Execution via ‘status’ Parameter.” The NVD description says the plugin “does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form.” It is the highest scored of the three at CVSS 6.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The WPScan advisory names the mechanism directly: “Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.”
CVE-2026-80437 covers Ninja Forms from 3.14.10 before 3.15.2, titled “Ninja Forms 3.14.10 – 3.15.1 – Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags.” NVD’s description: the plugin “does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.” CVSS 4.8, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. WPScan adds that an earlier patch closed only one vulnerable source and left the others in place, and that the site has to display one of the affected values for the flaw to be reachable.
CVE-2026-80439 covers Redirection for Contact Form 7 from 2.2.7 before 3.2.11, titled “Redirection for Contact Form 7 2.2.7 – 3.2.10 – Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags.” NVD: the plugin “does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action’s settings and then processes those settings for shortcodes, allowing unauthenticated users to run any shortcode registered on the site and read its output.” CVSS 4.8, same vector as Ninja Forms.
A fourth record from the same batch, CVE-2026-19862, is a separate email header injection issue in JetFormBuilder, also fixed in 3.6.5.2 and scored 4.8.
WPScan publishes proof-of-concept code for its advisories on a stated schedule rather than at disclosure. The Ninja Forms advisory says its demonstration becomes available on September 16, 2026. Both the JetFormBuilder and the Redirection for Contact Form 7 advisories give September 17, 2026, with the Redirection advisory putting the reason in one line: “The PoC will be displayed on September 17, 2026, to give users the time to update.”
All three CVE records carry a vulnStatus of Received. None has been analyzed by NVD, and none carries a CPE configuration block.
Why it matters
The scores say Medium and the scores are, in a narrow sense, right. Confidentiality and integrity impacts are Low in all three vectors, and against the form plugin’s own surface that is defensible. But the phrase every one of these records uses is “any shortcode registered on the site,” and what a shortcode does has nothing to do with the plugin that was tricked into running it.
A shortcode is a callable that some plugin or theme registered by name in the global registry. On a real WordPress install that registry holds dozens to hundreds of entries contributed by everything installed: membership plugins with shortcodes that render user lists, e-commerce plugins that output order data, directory plugins that dump post content the current visitor is not entitled to see, form builders that expose submissions. The three CVSS vectors here were scored against what Ninja Forms, JetFormBuilder, and Redirection for Contact Form 7 can do. The actual blast radius is decided by neighbors the scorer could not see. That is a structural limit of per-component scoring rather than a mistake by the scorer, and it means the number in the queue is systematically the wrong number for this bug class.
The ordering itself is worth naming, because it is the reusable part. Escaping makes a string inert as HTML. It does not make it inert as WordPress markup. When a plugin escapes a request-derived value and then hands the escaped result to a shortcode-expansion pass, the expansion pass reads bracket syntax as a function call, and it does so on a string that a developer has already convinced themselves is safe. The escaping was never wrong; it was answering a different question, and it was asked first. Herman’s three findings are the same sentence in three codebases: escape, then expand.
Severity Daily wrote up an adjacent shape on September 5, when three plugins reintroduced comment XSS that WordPress core had already sanitized, by decoding entities again on output. That is the mirror image of this one. There, a later pass undid an escape that had already been applied correctly; here, an earlier escape is undone by a later pass that was always going to run. Both fail for the same structural reason: a value crosses a boundary between two components that each believe the other handled it. WPScan published a fourth record in today’s batch, CVE-2026-84219 in the Kirki theme framework, that belongs to the September 5 class rather than this one.
The Ninja Forms detail about an incomplete earlier patch is the practical warning. Merge tags are not a bug in that plugin; substituting request-derived values into content is the feature. That makes the vulnerable surface a list — every source a merge tag can draw from — and a fix applied source by source will keep leaving items on the list. The only durable fix is to change the order, expanding shortcodes before user data is substituted in, or to strip bracket syntax from substituted values entirely.
Finally, there is a real date on this. Federal deadlines do not apply to WordPress plugins and there is no KEV listing here, but WPScan has said in writing when the working demonstrations become public: September 16 for Ninja Forms, September 17 for the other two. After those dates the cost of exploiting these drops to reading a page. Ten days is a generous disclosure window and it is also a countdown.
What to do
Update JetFormBuilder to 3.6.5.2, which also closes the email header injection in CVE-2026-19862. Update Ninja Forms to 3.15.2. Update Redirection for Contact Form 7 to 3.2.11. All three fixed releases are already out; nothing here is waiting on a vendor.
Do the updates before September 16, 2026, not after. That is the first of the two proof-of-concept publication dates, and it is the only fixed date in this story.
If an update has to wait, the exposure is narrower than the description sounds in one specific way: WPScan notes for Ninja Forms that a site must actually display one of the affected values for the flaw to be reachable. Confirming whether any public template renders submitted values, the visitor IP, or the referer is a reasonable way to rank which sites go first. It is a triage aid, not a mitigation.
Independent of these three plugins, this is a good moment to look at what shortcodes are registered on sites that accept unauthenticated form submissions. The impact of any escape-then-expand bug is set by that list, and most operators have never seen it.
Sourcing note
Checked: the NVD API records for CVE-2026-19859, CVE-2026-19862, CVE-2026-80437, and CVE-2026-80439, and the three WPScan advisory pages the records cite. All version ranges, scores, vectors, titles, quoted descriptions, credits, and proof-of-concept dates come from those two sources, which agree with each other on every version boundary.
Could not reach: the wordpress.org plugin API and plugin directory pages, which are disallowed to automated fetching by robots rules. This story therefore states no active-install figures for any of the three plugins and does not characterize the size of the affected population. Vendor changelogs for the three fixed releases were not independently read; the fixed version numbers here are WPScan’s and NVD’s.
Unresolved: the proof-of-concept code is not public yet, so the exploitation path has not been independently verified. No exploitation of any of these has been reported by anyone, and none of the three records carries a CISA KEV entry. Whether the plugins’ vendors have described these issues in their own release notes, and in what terms, is not established here.