NF
Product
Ninja Forms – The Contact Form Builder That Grows With You
17
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 12Low 0
Watch
Add Ninja Forms – The Contact Form Builder That Grows With You to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-0685 | 9.8 | Feb 2 | Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection Affected: through 3.7.1 |
| CVE-2026-1239 | 7.5 | Jul 1 | Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint Affected: through 3.14.1 |
| CVE-2026-2268 | 7.5 | Feb 10 | Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action Affected: through 3.14.0 |
| CVE-2025-11924 | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token Affected: through 3.13.2 |
| CVE-2026-19769 | 7.2 | Sep 5 | Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key Affected: through 3.15.1 |
| CVE-2026-11363 | 6.6 | Sep 9 | Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import Affected: through 3.14.6 |
| CVE-2026-1307 | 6.5 | Mar 28 | Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token Affected: through 3.14.1 |
| CVE-2024-12238 | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: through 3.8.22 |
| CVE-2024-11052 | 6.1 | Dec 12 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations Affected: through 3.8.19 |
| CVE-2024-3866 | 6.1 | Sep 25 | Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer Affected: through 3.8.15 |
| CVE-2025-10498 | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Affected: through 3.12.0 |
| CVE-2025-5398 | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Affected: through 3.10.2.1 |
| CVE-2024-13470 | 5.4 | Jan 30 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 3.8.24 |
| CVE-2024-2108 | 5.4 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting Affected: through 3.8.0 |
| CVE-2026-15663 | 4.9 | Jul 24 | Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key Affected: through 3.14.9 |
| CVE-2025-10499 | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Affected: through 3.12.0 |
| CVE-2024-2113 | 4.3 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export Affected: through 3.8.0 |
Showing 17