CVE-2023-37979

HighCVSS 7.1

Published: 27/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

6.01%

92th percentile - higher than 92% of all known CVEs

Summary

The Ninja Forms Contact Form plugin versions up to 3.6.25 contains an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability. An attacker can exploit this flaw to inject malicious scripts.

Risk Assessment

Organizations using this plugin may be vulnerable to XSS attacks, potentially leading to user data theft or session hijacking.

Recommendation

It is recommended to update the Ninja Forms Contact Form plugin to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.