Stored XSS and Arbitrary File Write in Ninja Forms WordPress Plugin

The Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) and arbitrary file write attacks due to insufficient input sanitization and output escaping. Affecting all versions up to and including 3.15.1, the flaw specifically involves a Repeater Child 'type' confusion triggered by an unmatched array key. Exploitation of this vulnerability requires the Ninja Forms File Uploads add-on to be active.

Attackers can manipulate the child entry handling process to force the application to write attacker-controlled HTML files containing arbitrary JavaScript into web-server-writable directories. Because these files are written to locations such as the site root, they are served directly from the site origin, enabling the execution of malicious scripts whenever an administrator or user visits the injected page. This represents a significant risk to WordPress site integrity and user session security.

Attack Chain

1. An unauthenticated attacker identifies a WordPress site with the Ninja Forms plugin (version <= 3.15.1) and the File Uploads add-on active.
2. The attacker crafts a malicious request payload targeting the Repeater Child handler in the plugin.
3. The payload utilizes array key confusion to bypass existing input sanitization filters within the plugin logic.
4. The request is routed through the File Uploads handler, which fails to validate the file type or destination path.
5. The plugin writes an attacker-supplied HTML file containing malicious JavaScript to a web-server-writable directory on the target filesystem.
6. The injected file is successfully stored in a location accessible via the web server (e.g., the site root).
7. A victim (typically an administrator) accesses the malicious file via the web browser.
8. The browser renders the HTML file, executing the injected JavaScript in the context of the vulnerable site origin.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to unauthorized administrative actions, account takeover, or the exfiltration of sensitive site data. Organizations running vulnerable versions of Ninja Forms on WordPress are at risk of complete site compromise if an administrative session is hijacked via the injected scripts.

Recommendation

Update the Ninja Forms plugin to the latest available version beyond 3.15.1 to incorporate the necessary input sanitization fixes. Detection teams should audit web access logs for anomalous POST requests directed at the File Uploads or Repeater endpoints. If an immediate patch is not possible, disable the File Uploads add-on to mitigate the identified vector.