Medium · 4.8 CVE-2021-36827 EUVD-2021-23403GHSA-f2h8-cw2w-qx44

WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Published Jun 16, 2022 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".

Vendor	Product	Affected	Fixed
Saturday Drive	Ninja Forms Contact Form (WordPress plugin)	≤ 3.6.9	—