Is CVE-2024-3866 actively exploited?

No active exploitation of CVE-2024-3866 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-3866 be exploited remotely?

Yes. CVE-2024-3866 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-3866?

CVE-2024-3866 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2024-3866

MEDIUM

CVE-2024-3866

CWE-79Published: September 25, 2024· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" for a targeted form to be enabled. However, there is no setting available to the attacker or even an administrator-level user to enable this mode. The mode is only enabled during a required update, which is a very short window of time. Additionally, because of the self-based nature of this vulnerability, attackers would have to rely on additional techniques to execute a supplied payload in the context of targeted user.

NVD Source

Technical Analysis

CVE-2024-3866 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.