.. / CVE-2018-19287

• XSS
• Nuclei
• Web

Exploit for WordPress Ninja Forms <3.3.18 - Cross-Site Scripting (CVE-2018-19287)

Description:

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begin_date, end_date, or form_id parameters. This can allow an attacker to steal cookie-based authentication credentials and launch other attacks.

Nuclei Template

View the template here CVE-2018-19287.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2018/CVE-2018-19287.yaml

References: