CVE-2023-37979: WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
First published: Thu Jul 27 2023(Updated: )
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.
Credit: audit@patchstack.com audit@patchstack.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ninja Forms | <3.6.26 |
Remedy
Update to 3.6.26 or a higher version.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://patchstack.com/articles/multiple-high-severity-vulnerabilities-in-ninja-forms-plugin?_s_id=cve
- https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
- http://packetstormsecurity.com/files/173983/WordPress-Ninja-Forms-3.6.25-Cross-Site-Scripting.html
Frequently Asked Questions
What is the severity of CVE-2023-37979?
The severity of CVE-2023-37979 is high with a CVSS score of 6.1.
How does the "Unauth. Reflected Cross-Site Scripting (XSS)" vulnerability in Saturday Drive Ninja Forms Contact Form plugin affect my website?
The vulnerability allows attackers to inject malicious code into webpages viewed by users, potentially leading to unauthorized actions or data theft.
What is the affected software by CVE-2023-37979?
The affected software is the Saturday Drive Ninja Forms Contact Form plugin version 3.6.25 and below for WordPress.
How can I fix the Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin?
Update your Saturday Drive Ninja Forms Contact Form plugin to version 3.6.26 or higher.
Where can I find more information about CVE-2023-37979?
You can find more information about CVE-2023-37979 at the following references: [1](https://patchstack.com/articles/multiple-high-severity-vulnerabilities-in-ninja-forms-plugin?_s_id=cve), [2](https://patchstack.com/database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve), [3](http://packetstormsecurity.com/files/173983/WordPress-Ninja-Forms-3.6.25-Cross-Site-Scripting.html)
- agent/author
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/remedy
- agent/title
- agent/first-publish-date
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-latest
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/ninjaforms
- canonical/ninja forms