CVE-2026-15161 Overview
CVE-2026-15161 is a Stored Cross-Site Scripting (XSS) vulnerability in the Ninja Forms - Excel Export plugin for WordPress. The flaw affects all plugin versions up to and including 3.3.6. Authenticated attackers with subscriber-level access or higher can inject arbitrary JavaScript that executes when administrators or other users view affected admin pages. The vulnerability stems from missing capability checks, absent nonce verification, and lack of output escaping in the plugin's filter storage and rendering logic [CWE-79].
Critical Impact
Low-privileged authenticated users can store malicious scripts that execute in higher-privileged users' browsers, enabling session theft, account takeover, and administrative action hijacking.
Affected Products
- Ninja Forms - Excel Export plugin for WordPress (versions ≤ 3.3.6)
- WordPress installations using the vulnerable plugin
- Administrative users accessing the Excel Export screen on affected sites
Discovery Timeline
- 2026-07-17 - CVE-2026-15161 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-15161
Vulnerability Analysis
The vulnerability resides in the Ninja Forms - Excel Export plugin's filter management workflow. The save_filter() AJAX handler accepts the raw $_POST['filter'] array and persists it directly to the WordPress options table using update_option(). This save operation performs no capability check, no nonce verification, and no input sanitization. Any authenticated user, including subscribers, can invoke the AJAX action and store arbitrary content.
The injected data is later read back by the get_filter_row() method on the admin Excel Export screen. That method concatenates the stored filter values (field_key, condition, and value) directly into HTML attributes without applying esc_attr(). When an administrator loads the Excel Export page, the browser parses the attacker-controlled attribute payload and executes the injected script in the administrator's session context.
Root Cause
The root cause combines two distinct failures. First, the save-side handler lacks authorization and input validation, allowing untrusted low-privileged input into a privileged storage location. Second, the render-side function outputs stored data into HTML attributes without escaping. Either control alone would mitigate the issue; their combined absence produces a stored XSS primitive [CWE-79].
Attack Vector
An authenticated subscriber sends a crafted POST request to the plugin's save_filter AJAX endpoint with a malicious payload in the filter array. The payload is stored persistently in wp_options. When any privileged user visits the Excel Export admin screen, get_filter_row() writes the attacker payload into an HTML attribute, breaking out of the attribute context and executing JavaScript with the victim's privileges. Refer to the Wordfence Vulnerability Report and WordPress Plugin Code Review for source-level analysis.
Detection Methods for CVE-2026-15161
Indicators of Compromise
- Unexpected entries in the wp_options table containing HTML tags, on* event handlers, or javascript: URIs within Ninja Forms Excel Export filter values.
- POST requests to admin-ajax.php with action=save_filter originating from subscriber-level or non-administrative accounts.
- Administrator sessions performing unexpected actions shortly after visiting the Excel Export admin screen.
Detection Strategies
- Review web server access logs for admin-ajax.php calls tied to the plugin's save_filter action from low-privileged users.
- Query stored plugin options for suspicious characters such as <script, onerror=, or onload= inside filter fields.
- Deploy a WordPress security scanner or web application firewall rule targeting XSS payloads in AJAX filter parameters.
Monitoring Recommendations
- Monitor creation of new administrator accounts or privilege changes following visits to the Excel Export screen.
- Alert on outbound requests from admin browsers to unknown domains, which may indicate cookie exfiltration.
- Track plugin option changes over time using file integrity and database change monitoring tooling.
How to Mitigate CVE-2026-15161
Immediate Actions Required
- Deactivate the Ninja Forms - Excel Export plugin until a patched version is available and installed.
- Audit all WordPress user accounts and remove or downgrade unnecessary subscriber-level accounts.
- Inspect the wp_options table for stored filter entries and remove any containing HTML or script content.
Patch Information
At publication, all versions up to and including 3.3.6 are affected. Administrators should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Report for an official fix, then update immediately once released. A proper fix must add a capability check (for example current_user_can('manage_options')), nonce verification via check_ajax_referer(), input sanitization on save, and esc_attr() on output.
Workarounds
- Restrict user registration or set the default new-user role to a value that cannot authenticate to admin-ajax.php filter actions where feasible.
- Deploy a web application firewall rule to block POST requests to admin-ajax.php with action=save_filter from non-administrative sessions.
- Remove the plugin entirely if Excel export functionality is not business-critical.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
