Description
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Ninja Forms | 3.14.10 – < 3.15.2 | 3.15.2 |
References
- wpscan.com exploit vdb-entry technical-description