Description (CNA)
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SaturdayDrive / Ninja Forms - Excel Export | affected 0 through 3.3.6 |
CWE
CWE-79
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ab836b-2798-43bd-b43b-8b7c7e81d42f?source=cve
- https://plugins.trac.wordpress.org/browser/ninja-forms-excel-export/trunk/includes/Admin/Menus/ExcelExport.php#L236
ADP enrichment
No English description supplied.
No references supplied.