The Ninja Forms – Excel Export plugin stores the submitted filter array directly into a WordPress option without checking user capabilities, verifying a nonce, or sanitizing the data. When that data is later included in HTML attributes on an admin page, it allows an attacker who is logged in with a subscriber‑level account or higher to inject arbitrary JavaScript. The injected scripts execute whenever a user opens the affected admin page, resulting in a stored cross‑site scripting vulnerability (CWE‑79).

Any WordPress installation that has the Ninja Forms – Excel Export plugin version 3.3.6 or earlier installed is affected. The flaw originates in the save_filter() AJAX handler and the get_filter_row() rendering code; therefore, all sites using this plugin and permitting subscriber‑level access to the plugin’s admin screens are potentially vulnerable.

The CVSS base score of 6.4 categorizes this as a medium‑severity flaw. The EPSS score is reported as less than 1 %, indicating that exploitation is currently unlikely. It is not listed in the CISA KEV catalog. Attackers must be authenticated with at least subscriber privileges and have access to the plugin’s admin interface to craft a malicious filter. Once the malicious filter is stored, it is immediately available for abuse whenever any user displays the relevant admin page.