CVE-2024-29220

2024-04-1103:15:09

jpcert

web.nvd.nist.gov

ninja forms

cross-site scripting

vulnerability

arbitrary script

web browser

user access

AI Score

6.2

Confidence

High

EPSS

Percentile

15.5%

JSON

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.

Affected configurations

Vulners

Node

saturday_driveninja_formsRange<3.8.1

VendorProductVersionCPE
saturday_driveninja_forms*cpe:2.3:a:saturday_drive:ninja_forms:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
saturday_drive	ninja_forms	*	cpe:2.3:a:saturday_drive:ninja_forms::::::::

CNA Affected

[
  {
    "vendor": "Saturday Drive",
    "product": "Ninja Forms",
    "versions": [
      {
        "version": "prior to 3.8.1",
        "status": "affected"
      }
    ]
  }
]