Stored Cross-Site Scripting Vulnerability in Ninja Forms Scheduled Exports

CVE-2026-87870

What is CVE-2026-87870?

The Ninja Forms - Scheduled Exports plugin for WordPress is susceptible to Stored Cross-Site Scripting due to insufficient input sanitization in REST API parameters such as interval, format, and emailTo. The vulnerability allows authenticated users with subscriber-level privileges or higher to inject malicious scripts into pages. These scripts execute when users visit the compromised pages. The REST API endpoint is inadequately secured, lacking a permission callback and only validating a nonce without assessing user capabilities, leading to potential exploitation.

References