Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-37979

42
FAUCET Score

CVE-2023-37979 is an unauthenticated reflected Cross-Site Scripting (XSS) vulnerability affecting Saturday Drive Ninja Forms Contact Form plugin versions up to and including 3.6.25. With a CVSS score of 6.1 (Medium) and a FAUCET Risk Score of 98/100, this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to information disclosure and defacement. While not listed in CISA's KEV catalog, exploit code is publicly available via ExploitDB and Nuclei templates, and it has garnered significant community discussion and media coverage, indicating a high likelihood of exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.6.26CPE matchmatch criteria
cpe:2.3:a:ninjaforms:ninja_forms:*:*:*:*:*:wordpress:*:*

CVSS Data

CVSS version used by this source: 3.1

7.1HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
Exploitability Score
2.8
Impact Score
3.7
CvssVersion
3.1

Exploit Intelligence

EPSS Score
6.01%
Probability of exploitation in next 30 days
EPSS Percentile
92.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
Nuclei: CVE-2023-37979 · Aug 1, 2023
ExploitDB: EDB-51644 · Aug 4, 2023
This CVE's current EPSS score of 0.0601 is in the 97th percentile among its peer group of 26,219 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Remediation records are not available for this CVE.

References

packetstormsecurity.com / files/173983/WordPress-Ninja-Forms-3.6.25-Cross-Site-Scripting.html
patchstack.com / articles/multiple-high-severity-vulnerabilities-in-ninja-forms-plugin
Third Party Advisory
patchstack.com / database/vulnerability/ninja-forms/wordpress-ninja-forms-plugin-3-6-25-reflected-cross-site-scripting-xss-vulnerability
Third Party Advisory