CyberRota Analysis
AI-GeneratedNinja Forms version 3.15.3 in WordPress is vulnerable due to improper handling of user input, allowing an attacker to inject and execute malicious scripts within the WordPress admin interface. This vulnerability poses a high risk as it can lead to unauthorized actions or data exposure when an administrator accesses the compromised submission URL. WordPress administrators and site maintainers should prioritize patching this issue to mitigate potential exploitation.
Original NVD Description
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.