CVE-2015-2220: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninjaformsfield1 parameter in a ninjaformsajaxsubmit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2220?
CVE-2015-2220 is considered to have a medium severity level due to its potential to allow cross-site scripting attacks.
How do I fix CVE-2015-2220?
To fix CVE-2015-2220, update the Ninja Forms plugin to version 2.8.9 or later.
Who is affected by CVE-2015-2220?
CVE-2015-2220 affects users of the Ninja Forms plugin for WordPress versions prior to 2.8.9.
What type of vulnerability is identified in CVE-2015-2220?
CVE-2015-2220 identifies multiple cross-site scripting (XSS) vulnerabilities.
Can CVE-2015-2220 be exploited by remote attackers?
Yes, CVE-2015-2220 allows remote attackers to inject arbitrary web scripts or HTML.