Cross-Site Scripting Issue in Popup Addon for Ninja Forms by WordPress
CVE-2025-53279

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Popup Addon For Ninja Forms
Vendor
CVE Published:
27 June 2025

What is CVE-2025-53279?

The Popup Addon for Ninja Forms contains a vulnerability that can be exploited through improper neutralization of input during web page generation, leading to DOM-based Cross-Site Scripting (XSS). This vulnerability affects versions from n/a up to 3.4, potentially allowing attackers to inject malicious scripts into pages viewed by users. It is crucial for site administrators using this plugin to take necessary precautions to mitigate the risk associated with this vulnerability.

Affected Version(s)

Popup addon for Ninja Forms <= 3.4

References

https://patchstack.com/database/wordpress/plugin/popup-ad...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
JSON
.