NF
Product
Ninja Forms
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 39Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-34647 | 6.5 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in… Affected: through 3.5.7 |
| CVE-2020-36174 | 6.5 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration Affected: before 3.4.27.1 |
| CVE-2024-12238 | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: before 3.8.23 |
| CVE-2024-11052 | 6.1 | Dec 12 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations Affected: before 3.8.20 |
| CVE-2024-3866 | 6.1 | Sep 25 | Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer Affected: before 3.8.16 |
| CVE-2024-7354 | 6.1 | Sep 2 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS Affected: 3.8.6 before 3.8.11 |
| CVE-2024-29220 | 6.1 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels Affected: before 3.8.1 |
| CVE-2023-37979 | 6.1 | Jul 27 | WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS) Affected: before 3.6.26 |
| CVE-2023-1835 | 6.1 | May 15 | Ninja Forms < 3.6.22 - Reflected XSS Affected: before 3.6.22 |
| CVE-2021-24165 | 6.1 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect… Affected: before 3.4.34 |
| CVE-2020-12462 | 6.1 | Apr 29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS Affected: before 3.4.24.2 |
| CVE-2017-18574 | 6.1 | Aug 22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder Affected: before 3.0.31 |
| CVE-2018-19796 | 6.1 | Dec 3 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions… Affected: before 3.3.19.1 |
| CVE-2018-7280 | 6.1 | Feb 21 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS Affected: before 3.2.14 |
| CVE-2025-10498 | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Affected: before 3.12.1 |
| CVE-2025-5398 | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Affected: before 3.10.2.2 |
| CVE-2024-13470 | 5.4 | Jan 30 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: before 3.8.25 |
| CVE-2024-26019 | 5.4 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing Affected: before 3.8.1 |
| CVE-2024-2108 | 5.4 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting Affected: before 3.8.1 |
| CVE-2021-24166 | 5.4 | Apr 5 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it… Affected: before 3.4.34 |
| CVE-2020-8594 | 5.4 | Feb 14 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],… Affected: 3.4.22 |
| CVE-2025-14072 | 5.3 | Jan 2 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure Affected: before 3.13.3 |
| CVE-2023-35909 | 5.3 | Dec 7 | WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack Affected: before 3.6.26 |
| CVE-2020-36175 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field Affected: before 3.4.27.1 |
| CVE-2020-36173 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields Affected: before 3.4.28 |
| CVE-2025-2561 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2560 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2524 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2024-50514 | 4.8 | Nov 19 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.16 |
| CVE-2024-50515 | 4.8 | Nov 19 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.16 |
| CVE-2024-43999 | 4.8 | Sep 17 | WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability Affected: before 3.8.12 |
| CVE-2023-5530 | 4.8 | Nov 6 | Ninja Forms < 3.6.34 - Admin+ Stored XSS Affected: before 3.6.34 |
| CVE-2021-25066 | 4.8 | Jul 4 | Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import Affected: before 3.6.10 |
| CVE-2021-25056 | 4.8 | Jul 4 | Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting Affected: before 3.6.10 |
| CVE-2021-36827 | 4.8 | Jun 16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label" Affected: through 3.6.9 |
| CVE-2025-10499 | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Affected: before 3.12.1 |
| CVE-2024-2113 | 4.3 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export Affected: before 3.8.1 |
| CVE-2021-34648 | 4.3 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up… Affected: through 3.5.7 |
| CVE-2021-24164 | 4.3 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the… Affected: before 3.4.34.1 |
Showing 39