CVE-2018-19287

PoC —

CVSS 3.0

6.1 medium

EPSS

9%p95

Published

Nov 15, 2018 (Nov 15, 2018)

Modified

Jun 17, 2026

Description

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.

Vendors: ninjaforma
Products: ninja forms
Ecosystems: WordPress
Weakness: CWE-79
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (8.9%)

In the news0 stories

No ingested article mentions this CVE yet.