Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2023-37979 — Cross-site Scripting in Ninja Forms

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
CNA7.1
EPSS
24.0%
top 3.96%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Ninjaforms Ninja FormsSaturday Drive Ninja Forms Contact Form
Timeline
PublishedJul 27
Latest updateAug 4

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5saturday_drive/ninja_forms_contact_formn/a — 3.6.25

🔴Vulnerability Details

2
CVEList
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)↗2023-07-27
▶
GHSA
GHSA-hv7m-p8cr-7667: Unauth↗2023-07-27
▶

💥Exploits & PoCs

2
Exploit-DB
WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS↗2023-08-04
▶
Nuclei
Ninja Forms < 3.6.26 - Cross-Site Scripting
▶
CVE-2023-37979 — Cross-site Scripting in Ninja Forms | cvebase