Threats tagged 'ghsa-6x82-24xh-w634'

The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to stored cross-site scripting (XSS) via the 'formData.extra' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The nonce check intended to prevent unauthorized requests is effectively bypassed due to the nf_ajax_submit endpoint issuing a valid nonce on failure, making exploitation straightforward.