CVE-2024-26019

2024-04-1103:15:09

jpcert

web.nvd.nist.gov

ninja forms

cross-site scripting

vulnerability

submit processing

arbitrary script

web browser

exploitation

AI Score

6.1

Confidence

High

EPSS

Percentile

15.5%

JSON

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.

Affected configurations

Vulners

Node

saturday_driveninja_formsRange<3.8.1

VendorProductVersionCPE
saturday_driveninja_forms*cpe:2.3:a:saturday_drive:ninja_forms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
saturday_drive	ninja_forms	*	cpe:2.3:a:saturday_drive:ninja_forms::::::::

CNA Affected

[
  {
    "vendor": "Saturday Drive",
    "product": "Ninja Forms",
    "versions": [
      {
        "version": "prior to 3.8.1",
        "status": "affected"
      }
    ]
  }
]