Executive brief
The Ninja Forms Scheduled Exports plugin automates the delivery of form submission data via email on a scheduled basis. A stored cross-site scripting vulnerability allows authenticated users with subscriber-level access to inject malicious scripts into the plugin's configuration, which then execute when administrators or other users access the affected pages, potentially leading to account compromise or unauthorized actions.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the plugin's REST API endpoints that handle scheduled export parameters (interval, format, emailTo) in versions up to 3.0.3. The REST endpoint lacks proper input sanitization and output escaping, and is registered without a permission_callback—only validating a nonce without checking user capabilities. This allows authenticated attackers with subscriber-level privileges and above to inject arbitrary JavaScript code that persists in the database and executes in the browsers of users viewing the affected pages. The vulnerability requires user authentication but not administrative privileges.
Affected products
- Ninja Forms Scheduled Exports up to and including 3.0.3
Timeline
- 2026-09-10: disclosed