Security readout for executives and security teams
Plain-English summary
CVE-2018-19287 is a cross-site scripting issue in the WordPress Ninja Forms plugin before 3.3.18. A vulnerable site could let a remote attacker cause JavaScript to run through parameters on the submissions page. The sources do not provide CVSS scoring or evidence of active exploitation.
Executive priority
Treat this as a targeted maintenance priority, not an emergency based on current evidence. Patch any affected WordPress sites promptly because public exploit information exists and plugin XSS can affect admin trust boundaries.
Technical view
The CVE describes XSS in includes/Admin/Menus/Submissions.php, also called the submissions page, through begin_date, end_date, or form_id parameters in Ninja Forms before 3.3.18. A WordPress plugin Trac changeset and the plugin developer page are cited. Exploit-DB has a public exploit reference, but KEV is false.
Likely exposure
Exposure is limited to WordPress sites running Ninja Forms versions before 3.3.18. The provided sources do not define required privileges, install prevalence, or whether unauthenticated access is possible.
Exploitation context
A public Exploit-DB reference exists, so defenders should assume technical details are publicly available. However, the provided sources do not show active exploitation, and CISA KEV status is false.
Researcher notes
Key unknowns remain: CVSS score, authentication requirements, reachable user roles, and exploitation in the wild. Validate directly against installed plugin versions and vendor release history rather than assuming all Ninja Forms deployments are affected.
Mitigation direction
- Upgrade Ninja Forms to version 3.3.18 or later.
- Check the Ninja Forms developer page for current vendor guidance.
- Restrict WordPress admin access to trusted users and networks where practical.
- Review affected sites for unexpected plugin downgrades or stale copies.
Validation and detection
- Inventory WordPress sites using Ninja Forms and record plugin versions.
- Confirm no production site runs Ninja Forms before 3.3.18.
- Review logs for unusual submissions-page requests using begin_date, end_date, or form_id.
- Verify update completion in WordPress admin or deployment records.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-19287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://plugins.trac.wordpress.org/changeset/1974335/ninja-forms/trunk/includes/Admin/Menus/Submissions.phpCVE reference · x_refsource_MISC
- https://wordpress.org/plugins/ninja-forms/#developersCVE reference · x_refsource_MISC
- 45880CVE reference · exploit, x_refsource_EXPLOIT-DB
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.