CyberRota Analysis
AI-GeneratedThe Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 is vulnerable to an unauthenticated stored cross-site scripting (XSS) attack due to improper validation of submission indexes. An attacker can exploit this flaw by submitting a malicious payload through a public form, which can lead to severe consequences such as session-cookie theft, unauthorized account creation, and arbitrary content modification in the WordPress admin panel. WordPress site administrators using affected versions should prioritize immediate patching to mitigate the risk of exploitation.
Original NVD Description
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.