CVE Vulnerability Advisory Database

[Affected Scope] WordPress Ninja Forms plugin versions up to, and including, 3.15.5

[Impact] Unauthenticated attackers can inject malicious scripts via a single request, potentially leading to administrator session hijacking and site takeover

[Mitigation] Immediately update the Ninja Forms plugin to the latest secure version (3.15.6 or higher)

[Affected Scope] All versions of Meow Lightbox plugin for WordPress up to, and including, 5.6.4

[Impact] Unauthenticated attackers can inject arbitrary web scripts via the 'post_content' parameter, executing malicious JavaScript in the context of any user viewing the affected page under specific configurations

[Mitigation] Immediately update the Meow Lightbox plugin to the latest secure version (5.6.5 or higher) and apply temporary configuration workarounds if patching is delayed

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).