WordPress Plugin Vulnerabilities
Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting
Description
The plugin does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Proof of Concept
As admin, put the following payload in a field label: <img src=x onerror=alert(/XSS/)> The XSS will be triggered when editing the form, as well as in post/page where the form is embed
Affects Plugins
Fixed in version 3.6.10
References
Classification
Miscellaneous
Original Researcher
Muhammad Adel
Submitter website
Submitter twitter
Verified
Yes
Timeline
Publicly Published
2022-06-13 (about 9 months ago)
Added
2022-06-13 (about 9 months ago)
Last Updated
2023-03-13 (about 11 days ago)