PT-2025-46800 · Ninjaforms+1 · Aman Popup+1

Published 2025-11-13 · Updated 2025-11-13 · CVE-2025-64264

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Aman Popup addon for Ninja Forms versions through 3.5.1

Description The Aman Popup addon for Ninja Forms contains a flaw related to improper input handling during web page generation, leading to a Stored Cross-site Scripting (XSS) condition. This allows for the injection of malicious scripts into web pages. The vulnerability affects the Popup addon for Ninja Forms.

Recommendations Update the Aman Popup addon for Ninja Forms to a version newer than 3.5.1.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64264

Affected Products

Aman Popup

Ninja Forms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-64264 · Security Note
• https://t.me/CVEtracker/37218 · Telegram Post
• https://vdp.patchstack.com/database/Wordpress/Plugin/popup-addon-for-ninja-forms/vulnerability/wordpress-popup-addon-for-ninja-forms-plugin-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/popup-addon-for-ninja-forms/vulnerability/wordpress-popup-addon-for-ninja-forms-plugin-3-5-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note