CVE-2018-19287

MEDIUM NUCLEI

Ninja Forms <3.3.18 - XSS

Title source: llm

Description

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.

Exploits (1)

exploitdb WORKING POC

by MTK · textwebappsphp

https://www.exploit-db.com/exploits/45880

View Code ZIP pw:eip

Nuclei Templates (1)

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

MEDIUMVERIFIEDby theamanrawat

Shodan: http.html:/wp-content/plugins/ninja-forms/

FOFA: body=/wp-content/plugins/ninja-forms/

References (3)

[Patch, Third Party Advisory] https://plugins.trac.wordpress.org/changeset/1974335/ninja-forms/trunk/includes/Admin/Menus/Submissions.php

[Release Notes, Vendor Advisory] https://wordpress.org/plugins/ninja-forms/#developers

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/45880/

Scores

CVSS v3 6.1

EPSS 0.1222

EPSS Percentile 93.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

ninjaforma/ninja_forms < 3.3.18

Published Nov 15, 2018

Tracked Since Feb 18, 2026