NF
Product
Ninja Forms
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 39Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-39628 | 8.8 | Aug 26 | WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability Affected: before 3.8.7 |
| CVE-2023-38393 | 8.8 | Jun 19 | WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability Affected: through 3.6.26 |
| CVE-2024-25572 | 8.8 | Apr 11 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31 Affected: before 3.4.31 |
| CVE-2021-24163 | 8.8 | Apr 5 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for… Affected: before 3.4.34 |
| CVE-2018-16308 | 8.6 | Sep 1 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection Affected: before 3.3.14.1 |
| CVE-2025-11924 | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token Affected: before 3.13.1 |
| CVE-2018-20980 | 7.5 | Aug 22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering Affected: before 3.2.15 |
| CVE-2023-36505 | 7.2 | Apr 17 | WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion Affected: before 3.6.25 |
| CVE-2022-2903 | 7.2 | Sep 26 | NinjaForms < 3.6.13 - Admin+ PHP Objection Injection Affected: before 3.6.13 |
| CVE-2021-24889 | 7.2 | Nov 29 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections… Affected: before 3.6.4 |
Showing 10