Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability

Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request

The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests

WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability

WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability

Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31

The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for…

The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection

Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering

WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion

The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import…

The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections…

The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in…

The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations

Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer

Ninja Forms 3.8.6-3.8.10 - Reflected XSS

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels

WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)

Ninja Forms < 3.6.22 - Reflected XSS

In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect…

The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS

The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder

An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions…

The Ninja Forms plugin before 3.2.14 for WordPress has XSS

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting

The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it…

The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],…

Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack

The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field

The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields

Ninja Forms < 3.10.1 - Admin+ Stored XSS

Ninja Forms < 3.10.1 - Admin+ Stored XSS

Ninja Forms < 3.10.1 - Admin+ Stored XSS

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

Ninja Forms < 3.6.34 - Admin+ Stored XSS

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks…

The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even…