CVE-2024-26019

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Saturday Drive	Ninja Forms	prior to 3.8.1

References

https://jvn.jp/en/jp/JVN50361500/Third Party Advisory
https://ninjaforms.com/Product
https://wordpress.org/plugins/ninja-forms/Product
https://jvn.jp/en/jp/JVN50361500/Third Party Advisory
https://ninjaforms.com/Product
https://wordpress.org/plugins/ninja-forms/Product

Timeline

Published: Apr 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-26027.8CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code CVE-2024-260208.8An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead CVE-2024-260212.3Improper initialization in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially CVE-2024-260227.8Improper access control in some Intel(R) UEFI Integrator Tools on Aptio V for Intel(R) NUC may allow an authenticated user to potentially en CVE-2024-260234.2OS command injection vulnerability in BUFFALO wireless LAN routers allows a logged-in user to execute arbitrary OS commands.CVE-2024-260248.4SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server.CVE-2024-260257.8Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable CVE-2024-260267.5An SQL injection vulnerability exists in the BIG-IP Next Central Manager API (URI). Note: Software versions which have reached End of Techn CVE-2024-260277.8Uncontrolled search path for some Intel(R) Simics Package Manager software before version 1.8.3 may allow an authenticated user to potential CVE-2024-260285.4Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused CVE-2024-260299.8Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Access Control vulnerability that could result in a Securit CVE-2024-26036.3The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege