EUVD-2026-45136
GHSA-wwwp-3vpq-g9xq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R over the reporter's UI:N because stored XSS requires a victim admin to visit the page; all other metrics align with AV:N subscriber-level injection with cross-boundary scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored Cross-Site Scripting in the Ninja Forms Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into the admin Excel Export screen. The dual root cause is a missing capability check and nonce verification in the save_filter() AJAX handler - enabling any authenticated user to write arbitrary filter data to WordPress options - combined with unescaped concatenation of that data into HTML attributes in get_filter_row(). When administrative users subsequently visit the Excel Export admin page, the stored payload executes in their browser, enabling session hijack, credential theft, or further privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Ninja Forms Excel Export WordPress plugin (CPE: cpe:2.3:a:saturdaydrive:ninja_forms_-_excel_export:*:*:*:*:*:*:*:*), a form management add-on that extends the Ninja Forms ecosystem to support Excel-format data exports. The root cause maps to CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests in two distinct failures in ExcelExport.php. First, the save_filter() AJAX handler accepts the raw superglobal $_POST['filter'] array and passes it to update_option() without calling current_user_can() or verifying a nonce - any subscriber-level WordPress session can invoke it. Second, the get_filter_row() method (line 236 of ExcelExport.php per the trac reference) builds HTML table rows by concatenating the stored field_key, condition, and value fields directly into element attributes without applying WordPress's esc_attr() escape function. This classic split-injection pattern - unsanitized write via an unprotected AJAX endpoint, unsanitized read in a privileged rendering path - produces a persistent (stored) XSS that fires on every admin page load of the Excel Export screen.
RemediationAI
Update the Ninja Forms Excel Export plugin beyond version 3.3.6 immediately; consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e9ab836b-2798-43bd-b43b-8b7c7e81d42f for the confirmed patched release once published. No explicit patched version number appears in the available intelligence data, so verify the current plugin version in the WordPress plugin repository before upgrading. If an update is unavailable or cannot be applied immediately, the most targeted compensating control is to deactivate the Ninja Forms Excel Export plugin entirely - this eliminates both the vulnerable AJAX endpoint and the rendering path at the cost of losing Excel export functionality. As a secondary control, restrict WordPress user registration or audit existing subscriber-level accounts to reduce the attacker pool, noting this does not eliminate risk if any authenticated session exists. Blocking access to admin-ajax.php for unauthenticated requests does not help here since exploitation requires a valid authenticated session.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today