Description

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-10T03:17:00.497Z",
  "pubdate": "2026-09-10T03:17:00.497Z",
  "executiveSummary": "The Ninja Forms - Scheduled Exports plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from improper input sanitization and output escaping within the plugin's REST API endpoints.\nThe vulnerability affects all versions up to and including 3.0.3. By leveraging this flaw, an authenticated attacker with subscriber-level privileges or higher can inject arbitrary malicious JavaScript into the application.\nThis injected script executes within the context of a victim's browser whenever they access a page containing the payload. Successful exploitation allows for the compromise of user sessions, unauthorized actions on behalf of the user, and potential access to sensitive data stored within the WordPress environment.\nThe primary risk stems from the lack of granular permission checks in the REST API registration process, which fails to validate user capabilities, relying solely on nonce verification. This oversight enables low-privileged users to modify scheduled export configurations, thereby injecting malicious code that persists on the server and executes upon future viewings, posing a significant risk to the integrity and confidentiality of the affected WordPress installation.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling of REST API parameters—specifically 'interval', 'format', and 'emailTo'—within the Ninja Forms - Scheduled Exports plugin. The plugin registers REST API endpoints without implementing a proper permission_callback function, which is critical for enforcing WordPress user capability checks.\nBecause the registration mechanism relies exclusively on a nonce check, the endpoint fails to restrict access to authorized administrative users. Consequently, any authenticated user with at least subscriber-level permissions can interact with the vulnerable endpoint to transmit crafted malicious payloads.\nThe exploitation flow proceeds as follows: An authenticated attacker sends a POST or PUT request to the vulnerable REST endpoint. The request includes malicious JavaScript payloads embedded within the 'interval', 'format', or 'emailTo' parameters. Because the application logic fails to perform adequate input sanitization, these payloads are accepted by the server and stored directly within the plugin's database configurations for scheduled exports.\nWhen a user or administrator navigates to a backend page where these scheduled export parameters are rendered—specifically within the dashboard or plugin settings interfaces—the application fails to apply context-aware output escaping. As a result, the browser interprets the stored payload as legitimate script content, leading to the execution of arbitrary JavaScript.\nThe payload executes within the victim's browser session, granting the attacker the ability to perform actions identical to the victim. If an administrator visits the page, the attacker could potentially create new admin accounts, modify sensitive configuration settings, or exfiltrate session tokens and cookies. Given the nature of Stored XSS, the payload persists in the database until manually removed, ensuring that the script triggers every time an affected page is accessed.\nThe exposure is limited to authenticated users; however, the threshold of 'subscriber' is low enough to make this a significant vector for multi-user WordPress environments, such as membership sites or forums. The lack of validation on input types and the subsequent reflection of unsanitized data in the administrative interface constitute a classic failure in secure data handling and privilege validation."
}