The Ninja Forms Contact Form plugin for WordPress suffers from a reflected cross-site scripting vulnerability via the 'Referer' HTTP header due to improper input neutralization. This vulnerability exists in all versions up to and including 3.8.15. An attacker can inject malicious scripts that execute in the context of a user if the plugin is in 'maintenance mode,' a state only enabled briefly during updates and not accessible otherwise. The vulnerability requires user interaction and has a high attack complexity. There is no indication of an available patch or official remediation from the vendor at this time.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of a targeted user's browser, potentially leading to information disclosure or session manipulation. However, the requirement that 'maintenance mode' be enabled, which only occurs during a short update window and cannot be manually triggered, significantly limits the practical impact and exploitability of this vulnerability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since 'maintenance mode' is only enabled briefly during updates and cannot be manually activated, the risk is inherently limited. Users should monitor for vendor updates or patches addressing this issue and apply them promptly once available.