Stored Cross-Site Scripting in Ninja Forms Repeatable Fieldset

Ninja Forms before 3.14.9 does not escape the repetition index when rendering the submission summary for Repeatable Fieldset fields. An attacker who can manipulate form submission data may inject HTML or JavaScript that executes in the browser of anyone viewing the submission, such as site administrators reviewing entries. Sites using the Repeatable Fieldset feature on public forms are at risk.

This vulnerability affects the following application versions:

• Ninja Forms – The Contact Form Builder 3.8.3
• Ninja Forms – The Contact Form Builder 3.8.4
• Ninja Forms – The Contact Form Builder 3.8.5
• Ninja Forms – The Contact Form Builder 3.8.6
• Ninja Forms – The Contact Form Builder 3.8.7
• Ninja Forms – The Contact Form Builder 3.8.8
• Ninja Forms – The Contact Form Builder 3.8.9
• Ninja Forms – The Contact Form Builder 3.8.10
• Ninja Forms – The Contact Form Builder 3.8.11
• Ninja Forms – The Contact Form Builder 3.8.12
• Ninja Forms – The Contact Form Builder 3.8.13
• Ninja Forms – The Contact Form Builder 3.8.14
• Ninja Forms – The Contact Form Builder 3.8.15
• Ninja Forms – The Contact Form Builder 3.8.16
• Ninja Forms – The Contact Form Builder 3.8.17
• Ninja Forms – The Contact Form Builder 3.8.18
• Ninja Forms – The Contact Form Builder 3.8.19
• Ninja Forms – The Contact Form Builder 3.8.20
• Ninja Forms – The Contact Form Builder 3.8.21
• Ninja Forms – The Contact Form Builder 3.8.22
• Ninja Forms – The Contact Form Builder 3.8.23
• Ninja Forms – The Contact Form Builder 3.8.24
• Ninja Forms – The Contact Form Builder 3.8.25
• Ninja Forms – The Contact Form Builder 3.8.25.1
• Ninja Forms – The Contact Form Builder 3.9.0
• Ninja Forms – The Contact Form Builder 3.9.1
• Ninja Forms – The Contact Form Builder 3.9.2
• Ninja Forms – The Contact Form Builder 3.9.2.1
• Ninja Forms – The Contact Form Builder 3.10.0
• Ninja Forms – The Contact Form Builder 3.10.1
• Ninja Forms – The Contact Form Builder 3.10.2
• Ninja Forms – The Contact Form Builder 3.10.2.1
• Ninja Forms – The Contact Form Builder 3.10.2.2
• Ninja Forms – The Contact Form Builder 3.10.3
• Ninja Forms – The Contact Form Builder 3.10.4
• Ninja Forms – The Contact Form Builder 3.10.4.1
• Ninja Forms – The Contact Form Builder 3.11.0
• Ninja Forms – The Contact Form Builder 3.11.1
• Ninja Forms – The Contact Form Builder 3.11.1.1
• Ninja Forms – The Contact Form Builder 3.12.0
• Ninja Forms – The Contact Form Builder 3.12.1
• Ninja Forms – The Contact Form Builder 3.12.2
• Ninja Forms – The Contact Form Builder 3.12.2.1
• Ninja Forms – The Contact Form Builder 3.13.0
• Ninja Forms – The Contact Form Builder 3.13.1
• Ninja Forms – The Contact Form Builder 3.13.2
• Ninja Forms – The Contact Form Builder 3.13.3
• Ninja Forms – The Contact Form Builder 3.13.4
• Ninja Forms – The Contact Form Builder 3.14.0
• Ninja Forms – The Contact Form Builder 3.14.1
• Ninja Forms – The Contact Form Builder 3.14.2
• Ninja Forms – The Contact Form Builder 3.14.3
• Ninja Forms – The Contact Form Builder 3.14.4
• Ninja Forms – The Contact Form Builder 3.14.5
• Ninja Forms – The Contact Form Builder 3.14.6
• Ninja Forms – The Contact Form Builder 3.14.7
• Ninja Forms – The Contact Form Builder 3.14.8