PT-2024-38285 · WordPress · Ninja Forms

Erwan Lr · Published 2024-09-01 · Updated 2024-10-04 · CVE-2024-7354

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.8.11

Description The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs because the Ninja Forms WordPress plugin does not escape an URL before outputting it back in an attribute, leading to malicious script execution.

Recommendations For versions prior to 3.8.11, upgrade the affected plugin immediately to mitigate risks. As a temporary workaround, consider restricting access to the plugin's functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-7354

Affected Products

Ninja Forms

References · 9

• 🔥 https://wpscan.com/vulnerability/3c871dcd-51d7-4d3b-b036-efa9e066ff41 · Exploit
• https://osv.dev/vulnerability/CVE-2024-7354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7354 · Security Note
• https://twitter.com/VulmonFeeds/status/1830552828172964331 · Twitter Post
• https://twitter.com/CVEnew/status/1830491389500780999 · Twitter Post
• https://t.me/cvenotify/97062 · Telegram Post
• https://t.me/cvenotify/92984 · Telegram Post
• https://twitter.com/oktsec/status/1830534681638354985 · Twitter Post
• https://t.me/cvedetector/4611 · Telegram Post