CVE-2024-11052

Summary

CVE-2024-11052 is a stored Cross-Site Scripting (XSS) vulnerability affecting Ninja Forms, a popular WordPress contact form plugin. Versions up to and including 3.8.19 are susceptible to this issue. The vulnerability arises from insufficient sanitization and output escaping of the calculations parameter. This weakness enables unauthenticated attackers to inject malicious web scripts that execute whenever a user accesses an injected page.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.