CVE-2021-24165CWE-601

Ninja Forms < 3.4.34 - Administrator Open Redirect

published April 5, 2021

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01643 · 76.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-04-05T18:27Z
EPSS history
Timeline
  • 05 APR 18:27Z
    Ninja Forms < 3.4.34 - Administrator Open Redirect
    cvelistv5