<commit_before>#### Add Wordpress Plugin Ninja Forms XSS Vulnerability.

  Application: Wordpress Plugin 'Ninja Forms' 2.9.21
  Homepage: https://wordpress.org/plugins/ninja-forms
  Source Code: https://downloads.wordpress.org/plugin/ninja-forms.2.9.21.zip
  References: https://wpvulndb.com/vulnerabilities/8128
  Active Install: +200.000

#### Vulnerable packages*
        
  2.9.21
  
#### Usage:

##### Linux (Ubuntu 14.04.2 LTS):
```
msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf>  use auxiliary/scanner/http/wp_ninja_forms_xss_scanner 
msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf> auxiliary(wp_ninja_forms_xss_scanner)  show options 

Module options (auxiliary/scanner/http/wp_ninja_forms_xss_scanner):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target address range or CIDR identifier
   RPORT      80               yes       The target port
   TARGETURI  /                yes       The base path to the wordpress application
   THREADS    1                yes       The number of concurrent threads
   VHOST                       no        HTTP server virtual host
   WP_PASS                     yes       A valid password
   WP_USER                     yes       A valid username

msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf> auxiliary(wp_ninja_forms_xss_scanner)  info

       Name: WordPress Ninja Forms XSS Scanner<commit_msg>Added link to the module in the documentation<commit_after>#### Add Wordpress Plugin Ninja Forms XSS Vulnerability.

  Application: Wordpress Plugin 'Ninja Forms' 2.9.21
  Homepage: https://wordpress.org/plugins/ninja-forms
  Source Code: https://downloads.wordpress.org/plugin/ninja-forms.2.9.21.zip
  References: https://wpvulndb.com/vulnerabilities/8128
  Active Install: +200.000

#### Vulnerable packages*
        
  2.9.21

#### Module

  [wp_ninja_forms_xss_scanner.rb](https://github.com/espreto/wpsploit/blob/master/modules/auxiliary/scanner/http/wordpress/wp_ninja_forms_xss_scanner.rb)
  
#### Usage:

##### Linux (Ubuntu 14.04.2 LTS):
```
msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf>  use auxiliary/scanner/http/wp_ninja_forms_xss_scanner 
msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf> auxiliary(wp_ninja_forms_xss_scanner)  show options 

Module options (auxiliary/scanner/http/wp_ninja_forms_xss_scanner):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target address range or CIDR identifier
   RPORT      80               yes       The target port
   TARGETURI  /                yes       The base path to the wordpress application
   THREADS    1                yes       The number of concurrent threads
   VHOST                       no        HTTP server virtual host
   WP_PASS                     yes       A valid password
   WP_USER                     yes       A valid username

msfdevel 10.10.10.10 shell[s]:0 job[s]:0 msf> auxiliary(wp_ninja_forms_xss_scanner)  info

       Name: WordPress Ninja Forms XSS Scanner
{'fraction_non_alphanumeric': 0.10666666666666667, 'fraction_numerical': 0.03636363636363636, 'mean_word_length': 2.120037807183365, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 7, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 6, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 8, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3744939', 'n_tokens_mistral': 1146, 'n_tokens_neox': 993, 'n_words': 256}