Ninja Forms - Excel Export vulnerabilities

The Ninja Forms - Excel Export plugin for WordPress up to version 3.3.6 is vulnerable to Stored Cross-Site Scripting. This is due to missing capability checks, nonce verification, and input sanitization in the save_filter() AJAX handler, which stores the raw $_POST['filter'] array into a WordPress option, combined with the get_filter_row() method on the admin Excel Export screen concatenating stored filter values directly into HTML attributes without esc_attr().

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This allows authenticated attackers with subscriber-level access and above to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.

The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to and including 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user-controlled key. This allows authenticated attackers with subscriber-level access and above to enumerate any Ninja Forms form ID and download all stored submission data as an XLSX file.