CVE-2023-37979

HIGH NUCLEI

Ninja Forms < 3.6.26 - Unauthenticated Reflected Cross-Site Scripting

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 4 public exploits for CVE-2023-37979. PoCs published by Mehran Seifalinia, Mehran-Seifalinia, d0rb. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in WordPress Ninja Forms plugin version 3.6.25. It generates an HTML page that, when interacted with, triggers an XSS payload via a crafted form submission to the vulnerable endpoint.

Description

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.

Exploits (4)

exploitdb WORKING POC
by Mehran Seifalinia · pythonwebappsphp
https://www.exploit-db.com/exploits/51644

This exploit demonstrates a reflected XSS vulnerability in WordPress Ninja Forms plugin version 3.6.25. It generates an HTML page that, when interacted with, triggers an XSS payload via a crafted form submission to the vulnerable endpoint.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress Ninja Forms plugin version 3.6.25
Auth required
Prerequisites: Authenticated access to the WordPress admin panel · Ninja Forms plugin version 3.6.25 or earlier installed
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 14 stars
by Mehran-Seifalinia · poc
https://github.com/Mehran-Seifalinia/CVE-2023-37979

This repository contains a functional Python script and Nuclei template for exploiting CVE-2023-37979, a reflected XSS vulnerability in Ninja Forms WordPress plugin versions up to 3.6.25. The script generates an HTML PoC file that triggers the XSS payload when interacted with by an authenticated user.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Ninja Forms WordPress plugin <= 3.6.25
Auth required
Prerequisites: Authenticated WordPress user session · Ninja Forms plugin version <= 3.6.25
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026 Full analysis →
github WORKING POC 2 stars
by Mehran-Seifalinia · pythonpoc
https://github.com/Mehran-Seifalinia/CVE-Exploits/tree/main/2023/CVE-2023-37979

The repository contains a functional Python script that exploits CVE-2023-37979, a reflected XSS vulnerability in Ninja Forms WordPress plugin versions up to 3.6.25. The script generates an HTML PoC file that triggers the XSS via a crafted 'data' parameter in a POST request to the vulnerable endpoint.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Ninja Forms WordPress plugin <= 3.6.25
Auth required
Prerequisites: Target must have Ninja Forms plugin installed and vulnerable version (<= 3.6.25) · Victim must be authenticated and interact with the crafted HTML file
devstral-2 · analyzed Feb 27, 2026 Full analysis →
nomisec WORKING POC 2 stars
by d0rb · poc
https://github.com/d0rb/CVE-2023-37979

This repository contains a functional exploit for CVE-2023-37979, an unauthenticated reflected XSS vulnerability in the Ninja Forms Contact Form plugin (versions <= 3.6.25). The exploit sends a crafted payload to the vulnerable endpoint and checks for the presence of the plugin and its version.

Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Ninja Forms Contact Form plugin <= 3.6.25
No auth needed
Prerequisites: Target must have the Ninja Forms plugin installed and be running a vulnerable version (<= 3.6.25)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Nuclei Templates (1)

Ninja Forms < 3.6.26 - Cross-Site Scripting
MEDIUMVERIFIEDby r3Y3r53
Shodan: http.html:/wp-content/plugins/ninja-forms/
FOFA: body=/wp-content/plugins/ninja-forms/

Scores

CVSS v3 7.1
EPSS 0.4501
EPSS Percentile 97.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
ninjaforms/ninja_forms < 3.6.26
Saturday Drive/Ninja Forms Contact Form < 3.6.25
Published Jul 27, 2023
Tracked Since Feb 18, 2026