Source: National Vulnerability Database

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25056

104 hits since 2022-07-06

PHP Vulns Source Ratio: 17% (7102 total, 597 propagated, 3551 filtered)