CVE-2024-29220

2024-04-1102:29:10

jpcert

github.com

ninja forms

cross-site scripting

labels

AI Score

6.5

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.

CNA Affected

[
  {
    "vendor": "Saturday Drive",
    "product": "Ninja Forms",
    "versions": [
      {
        "status": "affected",
        "version": "prior to 3.8.1"
      }
    ]
  }
]