CVE-2021-25056

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting

EPSS 0.5%CWE-79

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Produtos afetados

Unknown · Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://wpscan.com/vulnerability/795acab2-f621-4662-834b-ebb6205ef7de