Threats tagged 'ghsa-wqc3-pwvg-9wvc'

The Ninja Forms WordPress plugin up to version 3.15.5 contains a vulnerability that allows authenticated users with subscriber-level access or higher to execute arbitrary shortcodes. This occurs because the plugin does not properly validate values before running do_shortcode, enabling shortcode injection via the user's display name if an administrator has configured a form field with the {wp:user_display_name} merge tag on a public page.