Lucene search
Sergio Navarro of DionachPATCHSTACK:D4C7BDDE0B0BDE74AA5A5F56D6158A83HistoryMar 05, 2015 - 12:00 a.m.
WordPress Ninja Forms Plugin <= 2.8.8 - Multiple XSS
2015-03-0500:00:00
Sergio Navarro of Dionach
patchstack.com
9
0.002 Low
EPSS
Percentile
59.7%
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the “ninja_forms_field_1” parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php. Also, multiple cross site scripting vulnerabilities allow the administrators to inject arbitrary web script or HTML via the “fields[1]” parameter to wp-admin/post.php.
Solution
Update the plugin.
| CPE | Name | Operator | Version |
|---|---|---|---|
| ninja forms | le | 2.8.8 |
Related
wpvulndb
wpvulndb
Ninja Forms <= 2.8.8 - Stored & Reflected XSS
2015-02-11 00:00:00
cve
cve
CVE-2015-2220
2015-03-05 16:59:02
cvelist
cvelist
CVE-2015-2220
2015-03-05 16:00:00
nvd
nvd
CVE-2015-2220
2015-03-05 16:59:02
checkpoint_advisories
checkpoint_advisories
WordPress Ninja Forms Plugin Cross-Site Scripting (CVE-2015-2220)
2016-02-01 00:00:00
prion
prion
Cross site scripting
2015-03-05 16:59:00
kaspersky
kaspersky
KLA10491 Multiple vulnerabilities in WordPress plugins
2015-03-17 00:00:00