The Ninja Forms - Scheduled Exports WordPress plugin is vulnerable to stored cross-site scripting (CWE-79) via REST API parameters 'interval', 'format', and 'emailTo' in versions up to and including 3.0.3. The vulnerability arises because the plugin does not properly sanitize or escape input before rendering it in web pages. The REST endpoint involved is registered without a permission_callback and only validates a nonce, failing to verify user capabilities. This allows authenticated users with subscriber-level privileges or higher to inject arbitrary scripts that execute in the context of other users viewing the injected content.

An attacker with subscriber-level access or higher can exploit this vulnerability to inject malicious JavaScript code that executes in the browsers of users who view the affected pages. This can lead to session hijacking, privilege escalation, or other attacks that leverage script execution in the victim's browser. The vulnerability does not affect unauthenticated users directly but lowers the barrier for attackers with limited privileges to perform cross-site scripting attacks.

No official patch or remediation is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and capabilities to trusted users only and monitor for suspicious activity related to the REST API endpoints. Avoid granting subscriber-level or higher privileges to untrusted users. Consider disabling the Scheduled Exports plugin if feasible until a fix is released.