Not rated
CVE-2021-24381 The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the…
Description
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.5 | earliest → < 3.5.8.2 | 3.5.8.2 |
Other CVEs of Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
The 9 CVEs of Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress →
CVE-2022-2903
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could…
7.2
High
CVE-2021-25066
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing…
Not rated
CVE-2021-25056
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high…
Not rated
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which…
Not rated