CVE-2023-5530: Ninja Forms < 3.6.34 - Admin+ Stored XSS

Q: What is the vulnerability ID for this Ninja Forms vulnerability?

The vulnerability ID for this Ninja Forms vulnerability is CVE-2023-5530.

Q: What is the severity of CVE-2023-5530?

The severity of CVE-2023-5530 is medium.

Q: What is the affected software for CVE-2023-5530?

The affected software for CVE-2023-5530 is Ninja Forms version up to and exclusive of 3.6.34 in WordPress.

Q: What is the CWE category for CVE-2023-5530?

The CWE category for CVE-2023-5530 is CWE-79.

Q: How can the Ninja Forms Stored XSS vulnerability be exploited?

The Ninja Forms Stored XSS vulnerability can be exploited by high privilege users, such as administrators, with the unfiltered_html capability.

Published Nov 6, 2023

Updated

The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfilteredhtml capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue

Affected Software

1 affected component

NinjaForms Ninja Forms Wordpress<3.6.34

Event History

Nov 6, 2023

CVE Published

via MITRE·08:41 PM

Data Sourced

via MITRE·08:41 PM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this Ninja Forms vulnerability?

The vulnerability ID for this Ninja Forms vulnerability is CVE-2023-5530.

What is the severity of CVE-2023-5530?

The severity of CVE-2023-5530 is medium.

What is the affected software for CVE-2023-5530?

The affected software for CVE-2023-5530 is Ninja Forms version up to and exclusive of 3.6.34 in WordPress.

What is the CWE category for CVE-2023-5530?

The CWE category for CVE-2023-5530 is CWE-79.

How can the Ninja Forms Stored XSS vulnerability be exploited?