CVE-2024-7354

MEDIUMNuclei

Ninja Forms 3.8.6-3.8.10 - Reflected XSS

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-7354 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 3, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Ninja Forms

Default status: unaffected

CVE List3.8.6 to < 3.8.11affected

ninja_forms

Browse ninjaforms / ninja_forms

Default status: unknown

CVE ListBefore 3.8.11affected

Nuclei templates

1
ProjectDiscoveryMEDIUMNinja Forms 3.8.6-3.8.10 - Cross-Site ScriptingCVSS 6.1

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Impact

Attackers can potentially exploit this vulnerability to gain unauthorized access to sensitive information.

Remediation

Update the plugin to Latest version. Fixed in 3.8.11.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024wpwordpresswp-pluginninja-formsxssauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*
Shodan: http.html:"/wp-content/plugins/ninja-forms/"
FOFA: body="/wp-content/plugins/ninja-forms"
https://wpscan.com/vulnerability/3c871dcd-51d7-4d3b-b036-efa9e066ff41/ https://nvd.nist.gov/vuln/detail/CVE-2024-7354

Source: ProjectDiscovery

References

2