CVE-2024-2113: kstover ninja forms – the contact form builder that grows with you Cross-site Scripting

Vulnerability summary

CVE-2024-2113 is a medium (CVSS 4.3) Cross-site Scripting vulnerability in kstover ninja forms – the contact form builder that grows with you. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.4% of scored vulnerabilities.

Timeline

1. 29-03-2024
   PublishedVulnerability first disclosed.
2. 08-04-2026
   Last modifiedVulnerability information updated.

Description

The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.