CVE-2024-26019

The Ninja Forms plugin for WordPress is vulnerable to a type of attack called Stored Cross-Site Scripting, which can occur when an authenticated administrator with elevated access injects malicious code into form fields. This code can then be executed by any user who visits the affected page, allowing the attacker to potentially take control of the site. The vulnerability is present in all versions of the plugin up to 3.8.0, but only affects multi-site installations or those where a specific security feature has been disabled.

Based on public CVE data (MITRE/NVD).