Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress, CVE-2024-7354
- CVE, Research URL
- Home page URL
-
Security reports for Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
- Published on
- Sep 02, 2024
- Research Description
- The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Affected versions
-
Min 3.8.6, max 3.8.10.
- Status
-
vulnerable