CVE Database /
CVE-2018-19287
CVE · Medium
CVE-2018-19287 — Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.18
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2018-19287
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.18 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 3.3.18
|
3.3.18 |
2018-11-15 |
—
|
CVE-2018-19287
A vulnerability exists in the Ninja Forms plugin for WordPress, prior to version 3.3.18, that allows an attacker to inject malicious JavaScript code. This is made possible by the plugin's failure to properly sanitize user input in the submissions page, specifically in the begin_date, end_date, and form_id parameters. As a result, a remote attacker can potentially execute arbitrary JavaScript code, potentially leading to further security issues.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings