CVE Database /
CVE-2021-24381
CVE · Medium
CVE-2021-24381 — Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.8
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2021-24381
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
4.8
|
< 3.6.8
|
3.6.8 |
2021-09-27 |
—
|
CVE-2021-24381
A vulnerability exists in the Ninja Forms Contact Form WordPress plugin prior to version 3.5.8.2, where the plugin does not properly sanitize and escape the custom class name of form fields, potentially allowing high-privilege users to inject malicious scripts even if the unfiltered HTML capability is restricted.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings