Ninja Forms - Excel Export

Ninja Forms - Excel Export is affected by cross-site scripting. Exploitation requires at least subscriber-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.3.6.

Ninja Forms Excel Export 3.3.6 and earlier accepts spreadsheet_export_tmp_name without constraining it to the export directory. A subscriber-level account can traverse the filesystem path and place generated spreadsheet files in attacker-selected locations, providing a useful staging primitive for further compromise.

Ninja Forms - Excel Export is affected by sensitive information exposure. Exploitation requires at least subscriber-level access. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.3.6.