CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
What the vulnerability does
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.
Explanation of Vulnerability in Simple Terms
Ninja Forms versions up to 3.8.11 contain a cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts. An attacker with admin privileges can craft a request that, when visited by another user, executes JavaScript in their browser. This affects the form builder interface and can compromise site security or user data.
What an attacker can do
Inject and execute JavaScript code in the browsers of other site users.
Potential impact on your site
An admin account compromise could allow an attacker to inject malicious scripts affecting other users and administrators.
Conditions required to exploit
Attacker must have administrator privileges and the victim must visit a page containing the malicious payload.
Key dates
External resources
Related vulnerabilities
