EUVD-2026-75230
GHSA-vxhj-7whr-2q55
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Stored XSS execution requires a victim to visit the injected page (UI:R); subscriber-level auth (PR:L) confirmed; scope change (S:C) reflects payload executing in victim browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.
AnalysisAI
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) an authenticated WordPress user account at subscriber level or above - the lowest default role, assigned automatically on open-registration sites; (2) the Ninja Forms - Scheduled Exports plugin to be installed and active on the target site at version 3.0.3 or earlier; (3) a victim user (typically an admin) to visit a page that renders the stored export configuration containing the injected payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 6.4 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N reflects network-accessible exploitation at low privilege with scope change into victim browsers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Ninja Forms - Scheduled Exports plugin to a version beyond 3.0.3 as soon as the vendor publishes a patched release; the exact remediated version number is not confirmed in available data, so consult the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/867ad3a9-7e43-48ac-b5bf-8bd47ccfd8c5 and the plugin changelog at https://ninjaforms.com/extensions/scheduled-submissions-export/ for the confirmed fix version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today