The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25066
88 hits since 2022-07-06
PHP Vulns Source Ratio: 17% (7122 total, 598 propagated, 3561 filtered)