6.1
Moyenne
CVE-2024-7354 The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute,…
Description
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ninja Forms 3.8 | 3.8.6 → < 3.8.11 | 3.8.11 |
| ninja_forms 3.8 | premières → < 3.8.11 | 3.8.11 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Ninja Forms
Les 11 CVE de Ninja Forms →
CVE-2026-91827
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when…
7.5
Élevée
CVE-2026-92438
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the…
8.8
Élevée
CVE-2026-80437
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…
4.8
Moyenne
CVE-2026-80438
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a…
5.9
Moyenne