WordPress security by component
Ninja Forms - Scheduled Exports
Ninja Forms - Scheduled Exports (ninja-forms-scheduled-exports) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Sep 10, 2026; the highest published CVSS base score is 6.4.
Plugin slug:
ninja-forms-scheduled-exportsLatest vulnerability
CVE-2026-87870: Ninja Forms Scheduled Exports stores subscriber scripts through REST parameters
Ninja Forms - Scheduled Exports through 3.0.3 registers a REST endpoint without permission_callback and checks a nonce without checking user capabilities. A Subscriber or higher-privileged user can submit script-bearing interval, format, or emailTo values. Insufficient sanitization and output escaping allow the stored input to execute as script when another user views affected content.
| Safe version |
|
||
|---|---|---|---|
| Sep 10, 2026 |
CVE-2026-87870
Ninja Forms Scheduled Exports stores subscriber scripts through REST parameters
Ninja Forms - Scheduled Exports through 3.0.3 registers a REST endpoint without permission_callback and checks a nonce without checking user capabilities. A Subscriber or higher-privileged user can submit script-bearing interval, format, or emailTo values. Insufficient sanitization and output escaping allow the stored input to execute as script when another user views affected content.
|
See mitigation notes |
CVE6.4
NVDPending
|