Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2024-7354

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
6.1MEDIUM
EPSS
1.2%
top 21.29%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Unknown Ninja FormsNinjaforms Ninja Forms
Timeline
PublishedSep 2

Description

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5unknown/ninja_forms3.8.6 — 3.8.11
▶NVDninjaforms/ninja_forms3.8.6 — 3.8.11

🔴Vulnerability Details

2
GHSA
GHSA-h3jv-jqj2-3j68: The Ninja Forms WordPress plugin before 3↗2024-09-02
▶
CVEList
Ninja Forms 3.8.6-3.8.10 - Reflected XSS↗2024-09-02
▶

💥Exploits & PoCs

1
Nuclei
Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting
▶