Source: National Vulnerability Database

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-25066

88 hits since 2022-07-06

PHP Vulns Source Ratio: 17% (7122 total, 598 propagated, 3561 filtered)