Shortcode Injection via Merge Tag Values in Ninja Forms

Ninja Forms does not neutralize WordPress shortcode syntax in merge tag values, which can be populated from request-supplied form field defaults without authentication. Where merge tag output is later processed by do_shortcode(), an attacker-supplied [shortcode] is executed instead of displayed, allowing execution of any shortcode registered on the site.

This vulnerability affects the following application versions:

• Ninja Forms – The Contact Form Builder 3.1.10
• Ninja Forms – The Contact Form Builder 3.2.28
• Ninja Forms – The Contact Form Builder 3.3.21.4
• Ninja Forms – The Contact Form Builder 3.4.34.2
• Ninja Forms – The Contact Form Builder 3.4.34.3
• Ninja Forms – The Contact Form Builder 3.5.8.4
• Ninja Forms – The Contact Form Builder 3.5.8.5
• Ninja Forms – The Contact Form Builder 3.6.34
• Ninja Forms – The Contact Form Builder 3.6.34.1
• Ninja Forms – The Contact Form Builder 3.7.3
• Ninja Forms – The Contact Form Builder 3.7.3.1
• Ninja Forms – The Contact Form Builder 3.8.0
• Ninja Forms – The Contact Form Builder 3.8.1
• Ninja Forms – The Contact Form Builder 3.8.2
• Ninja Forms – The Contact Form Builder 3.8.3
• Ninja Forms – The Contact Form Builder 3.8.4
• Ninja Forms – The Contact Form Builder 3.8.5
• Ninja Forms – The Contact Form Builder 3.8.6
• Ninja Forms – The Contact Form Builder 3.8.7
• Ninja Forms – The Contact Form Builder 3.8.8
• Ninja Forms – The Contact Form Builder 3.8.9
• Ninja Forms – The Contact Form Builder 3.8.10
• Ninja Forms – The Contact Form Builder 3.8.11
• Ninja Forms – The Contact Form Builder 3.8.12
• Ninja Forms – The Contact Form Builder 3.8.13
• Ninja Forms – The Contact Form Builder 3.8.14
• Ninja Forms – The Contact Form Builder 3.8.15
• Ninja Forms – The Contact Form Builder 3.8.16
• Ninja Forms – The Contact Form Builder 3.8.17
• Ninja Forms – The Contact Form Builder 3.8.18
• Ninja Forms – The Contact Form Builder 3.8.19
• Ninja Forms – The Contact Form Builder 3.8.20
• Ninja Forms – The Contact Form Builder 3.8.21
• Ninja Forms – The Contact Form Builder 3.8.22
• Ninja Forms – The Contact Form Builder 3.8.23
• Ninja Forms – The Contact Form Builder 3.8.24
• Ninja Forms – The Contact Form Builder 3.8.25
• Ninja Forms – The Contact Form Builder 3.8.25.1
• Ninja Forms – The Contact Form Builder 3.9.0
• Ninja Forms – The Contact Form Builder 3.9.1
• Ninja Forms – The Contact Form Builder 3.9.2
• Ninja Forms – The Contact Form Builder 3.9.2.1
• Ninja Forms – The Contact Form Builder 3.10.0
• Ninja Forms – The Contact Form Builder 3.10.1
• Ninja Forms – The Contact Form Builder 3.10.2
• Ninja Forms – The Contact Form Builder 3.10.2.1
• Ninja Forms – The Contact Form Builder 3.10.2.2
• Ninja Forms – The Contact Form Builder 3.10.3
• Ninja Forms – The Contact Form Builder 3.10.4
• Ninja Forms – The Contact Form Builder 3.10.4.1
• Ninja Forms – The Contact Form Builder 3.11.0
• Ninja Forms – The Contact Form Builder 3.11.1
• Ninja Forms – The Contact Form Builder 3.11.1.1
• Ninja Forms – The Contact Form Builder 3.12.0
• Ninja Forms – The Contact Form Builder 3.12.1
• Ninja Forms – The Contact Form Builder 3.12.2
• Ninja Forms – The Contact Form Builder 3.12.2.1
• Ninja Forms – The Contact Form Builder 3.13.0
• Ninja Forms – The Contact Form Builder 3.13.1
• Ninja Forms – The Contact Form Builder 3.13.2
• Ninja Forms – The Contact Form Builder 3.13.3
• Ninja Forms – The Contact Form Builder 3.13.4
• Ninja Forms – The Contact Form Builder 3.14.0
• Ninja Forms – The Contact Form Builder 3.14.1
• Ninja Forms – The Contact Form Builder 3.14.2
• Ninja Forms – The Contact Form Builder 3.14.3
• Ninja Forms – The Contact Form Builder 3.14.4
• Ninja Forms – The Contact Form Builder 3.14.5
• Ninja Forms – The Contact Form Builder 3.14.6
• Ninja Forms – The Contact Form Builder 3.14.7
• Ninja Forms – The Contact Form Builder 3.14.8
• Ninja Forms – The Contact Form Builder 3.14.9