CVE-2022-40840

38th percentile - higher than 38% of all known CVEs

The NdkAdvancedCustomizationFields 3.5.0 plugin for ndk design is vulnerable to Cross-Site Scripting (XSS) in the createPdf.php file. This allows an attacker to inject malicious JavaScript code into the page.

The risk includes potential session hijacking, redirection to malicious sites, or other actions performed in the victim's browser context.

It is recommended to immediately update the plugin to the latest version and implement input sanitization in the createPdf.php file.