Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.4.34 Clear all filters
TI-2021-06458 CVE-2021-24166 · GHSA-xxcm-3jff-m2m5

Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection

Priority LOW 25

The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request…

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00458 Published 2021-04-05 Fixed in 3.4.34 CWE-352
TI-2021-06457 CVE-2021-24165 · GHSA-f7h7-fph4-2w62

Ninja Forms < 3.4.34 - Administrator Open Redirect

Priority LOW 31

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01643 Published 2021-04-05 Fixed in 3.4.34 CWE-601
TI-2021-06455 CVE-2021-24163 · GHSA-pxq6-8799-5v2r

Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

Priority MEDIUM 41

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to i…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01439 Published 2021-04-05 Fixed in 3.4.34 CWE-200