漏洞描述
WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begin_date, end_date, or form_id parameters. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/fb036dc2-0ee8-4a3e-afac-f52050b3f8c7↗wordpress.orghttps://wordpress.org/plugins/ninja-forms/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2018-19287↗plugins.trac.wordpress.orghttps://plugins.trac.wordpress.org/changeset/1974335/ninja-forms/trunk/includes/Admin/Menus/Submissions.php↗