Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.6.10 Clear all filters
TI-2021-07344 CVE-2021-25066 · GHSA-fgg3-jvqw-q86r

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import

Priority LOW 23

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-07-04 Fixed in 3.6.10 CWE-79
TI-2021-07334 CVE-2021-25056 · GHSA-v8vg-mxf6-5vgh

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is dis…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00588 Published 2022-07-04 Fixed in 3.6.10 CWE-79