Headline
CVE-2021-36827: WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability - Patchstack
Authenticated (admin or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive’s Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
Verified
Fixed
4.8
CVSS 3.1 score Medium severity
Monitoring Coming soon
PSID
ba7b836a5ee1
Classification
Cross Site Scripting (XSS)
OWASP Top 10
A7: Cross-Site Scripting (XSS)
Required privilege
Requires high role user authentication like admin.
Publicly disclosed
2022-06-07
Details
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Asif Nawaz Minhas (Patchstack Alliance) in WordPress Ninja Forms Contact Form plugin (versions <= 3.6.9).
Solution
Update the WordPress Ninja Forms Contact Form plugin to the latest available version (at least 3.6.10).
References
Related news
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".