WordPress Plugin Vulnerabilities
Ninja Forms < 3.4.24.2 - CSRF to Stored XSS
Description
Ramuel Gall of Wordfence discovered a Cross-Site Request Forgery(CSRF) plugin vulnerability within the Ninja Forms WordPress plugin. By exploiting the CSRF vulnerability, an attacker could inject arbitrary malicious JavaScript via the import contact feature.
This vulnerability was reportedly fixed in version 3.4.24.2.
Affects Plugins
Fixed in 3.4.24.2 References
Classification
Type
CSRF
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Ramuel Gall (Wordfence)
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2020-04-29 (about 6 years ago)
Added
2020-04-29 (about 6 years ago)
Last Updated
2020-05-05 (about 6 years ago)
WPScan 