CVE-2026-15161
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Ninja Forms - Excel Export plugin for WordPress up to version 3.3.6 is vulnerable to Stored Cross-Site Scripting. This is due to missing capability checks, nonce verification, and input sanitization in the save_filter() AJAX handler, which stores the raw $_POST['filter'] array into a WordPress option, combined with the get_filter_row() method on the admin Excel Export screen concatenating stored filter values directly into HTML attributes without esc_attr().
Risk Assessment
An authenticated attacker with subscriber-level access or higher can inject arbitrary JavaScript code that executes whenever an administrator visits the affected page, potentially leading to session hijacking, content manipulation, or privilege escalation.
Recommendation
Update the Ninja Forms - Excel Export plugin to the latest available version immediately. As a temporary measure, restrict access to the WordPress admin panel to trusted users only.
Other vulnerabilities in Ninja Forms - Excel Export
See all- CVE-2026-15160Medium
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This allows authenticated attackers with subscriber-level access and above to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
- CVE-2026-15159Medium
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to enumerate any Ninja Forms form ID and download all stored submission data as an XLSX file.
Original NVD description (English source)
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.