Threats tagged 'ghsa-2xwp-m9v6-767p'

Ninja Forms WordPress plugin versions before 3.14.10 allow unauthenticated attackers to execute arbitrary shortcodes via user-supplied query-string input used to pre-populate form fields. This occurs because the plugin does not prevent such input from being processed as shortcodes when embedded on public pages.