Now officially on WordPress.org

CVE Database / CVE-2020-8594

CVE · Medium

CVE-2020-8594 — Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.23

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2020-8594 Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.23 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 5.4 < 3.4.23 3.4.23 2020-02-03 —

CVE-2020-8594

The Ninja Forms plugin for WordPress has a security flaw that allows attackers to inject malicious code into a website, which can then be executed by other users. This vulnerability is caused by the plugin not properly sanitizing user input for certain configuration settings, specifically those related to reCAPTCHA and date formatting. As a result, an attacker can inject malicious JavaScript code that can be executed by other users with various permissions, potentially leading to further security issues.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings