First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-7354

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
Unknown	Ninja Forms	>= 3.8.6, < 3.8.11
ninjaforms	ninja_forms	< 3.8.11

References

https://wpscan.com/vulnerability/3c871dcd-51d7-4d3b-b036-efa9e066ff41/Exploit, Third Party Advisory

Timeline

Published: Sep 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-73555.4The Organization chart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title_input’ and 'node_description' parame CVE-2024-73565.4The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘filename’ parameter in all versions up CVE-2024-73579.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-600 up to 2.18. It has been rated as critical. This issue affects th CVE-2024-73587.8A vulnerability was detected in Point B Ltd Getscreen Agent up to 2.19.6/3.9.4 on Windows. This affects an unknown function of the file gets CVE-2024-73596.1A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been rated as problematic. Affected by this is CVE-2024-73608.8A vulnerability classified as problematic has been found in SourceCodester Tracking Monitoring Management System 1.0. This affects an unknow CVE-2024-73619.8A vulnerability classified as critical was found in SourceCodester Tracking Monitoring Management System 1.0. This vulnerability affects unk CVE-2024-73629.8A vulnerability, which was classified as critical, has been found in SourceCodester Tracking Monitoring Management System 1.0. This issue af CVE-2024-73639.8A vulnerability, which was classified as critical, was found in SourceCodester Tracking Monitoring Management System 1.0. Affected is an unk CVE-2024-73649.8A vulnerability has been found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this vuln CVE-2024-73659.8A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0 and classified as critical. Affected by this issue is CVE-2024-73669.8A vulnerability was found in SourceCodester Tracking Monitoring Management System 1.0. It has been classified as critical. This affects an u