CVE-2024-43999 is a stored cross-site scripting vulnerability (CWE-79) in the Saturday Drive Ninja Forms plugin for WordPress, affecting versions through 3.8.11. The vulnerability occurs due to improper input neutralization during web page generation, enabling attackers with high privileges and requiring user interaction to execute malicious scripts in a context where the plugin is used. The CVSS 3.1 base score is 5.9, reflecting medium severity with network attack vector, low attack complexity, and partial impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet.

Successful exploitation could allow an attacker with high privileges to inject and store malicious scripts that execute when viewed by other users, potentially leading to partial compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and elevated privileges, limiting the attack scope. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit administrative access to trusted users and apply standard security controls to reduce risk. Monitor official Saturday Drive communications for updates on patches or mitigations.