CVE-2021-25056

CVE-2021-25056: Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting

Vendor Unknown

Product Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress

Weakness CWE-79 · XSS

Published July 4, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Key dates

02Disclosure timeline

July 4, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-25056

Related vulnerabilities

04Related CVE

CVE-2024-37551 WordPress Simple Social Share plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-0597 SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings CVE-2017-12347 CVE-2024-51901 WordPress Smooth Maps plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability CVE-2021-25313 Rancher: XSS on /v3/cluster/