Ninjaforms Ninja Forms File Uploads vulnerabilities

CVE-2022-0888 [CRITICAL] CWE-434 CVE-2022-0888: The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads du The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, i

CVE-2019-10869 [HIGH] CWE-22 CVE-2019-10869: Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordP Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.

CVE-2022-0889 [MEDIUM] CWE-79 CVE-2022-0889: The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scri The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and i

CVE-2024-1596 [MEDIUM] CWE-79 CVE-2024-1596: The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whe