Ninja Forms Scheduled Exports
Monthly
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.