Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2020-8594: The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_for...
CVE-2020-8594 · published 6 years ago
Summary
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ninjaforms | ninja_forms |
3.4.22 cpe:2.3:a:ninjaforms:ninja_forms:3.4.22:*:*:*:*:wordpress:*:* |
Original advisory text
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_for...
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
References
- https://spider-security.co.uk/blog-cve-cve-2020-8594 Exploit Third Party Advisory
- https://wordpress.org/plugins/ninja-forms/#developers Vendor Advisory
- https://wpvulndb.com/vulnerabilities/10070 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published14 Feb 2020
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-8594 · NVD
Track software like this
Free during beta