WordPress Ninja Forms plugin <= 3.6.9 - Cross-Site Scripting (XSS) Vulnerability

[Kailash]

WordPress Ninja Forms plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Plugin name: Ninja Forms Contact Form
Vulnerable versions: <= 3.6.9
Fixed in: 3.6.10
CVE ID: CVE-2021-25056
Classification: Cross Site Scripting (XSS)
Publicly disclosed: 2022-06-13

Vulnerability Details

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Muhammad Adel WordPress Ninja Forms plugin (versions <= 3.6.9).

Solution

Update the WordPress Ninja Forms plugin to the latest available version (at least 3.6.10).

Plugin Link: https://wordpress.org/plugins/ninja-forms/