Disclosure of vulnerability information reported by our employees (JVN#50361500)

The following vulnerability, reported by SB Technology employee Ryotaro Imamura, has been disclosed on JVN.

Overview
JVN#50361500
Multiple vulnerabilities in WordPress plugin Ninja Forms

• *Ninja Forms is a function (plugin) that allows you to create forms for WordPress.

■Affected systems

• Ninja Forms versions prior to 3.4.31

• Ninja Forms versions prior to 3.8.1

■ Anticipated impacts
The expected impacts vary depending on the vulnerability, but may include the following:

• If a site administrator accesses a maliciously crafted page while logged in to the product, unintended operations may be performed (CVE-2024-25572)
• Arbitrary scripts may be executed on the web browser of users who access sites that use the affected products (CVE-2024-26019, CVE-2024-29220)

Please see here for the detail.
Vulnerability Report: https://jvn.jp/jp/JVN50361500/
Vulnerability Countermeasure Information Database: https://jvndb.jvn.jp/ja/contents/2024/JVNDB-2024-000038.html

About Vendor Information
Saturday Drive

• Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress:
  https://ja.wordpress.org/plugins/ninja-forms/
• Ninja Forms - Your Drag & Drop WordPress Form Builder:
  https://ninjaforms.com/