Ninja Forms vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

NF

Product

Ninja Forms

by Saturday Drive · last CVE Oct 28, 2026

15

CVEs

0

On KEV

9.8

Max CVSS

1

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 4High 5Medium 6Low 0

Severity

All severities15 Critical4 High5 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Ninja Forms to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2024-37934	9.8	0%	Jul 9	WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability Affected: through 3.8.4
CVE-2023-38386	9.8	0%	Jun 19	WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability Affected: through 3.6.25
CVE-2026-65049	9.3	0%	Jul 21	Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action Affected: before 3.14.9
CVE-2026-65048	9.3	1%	Jul 21	Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index Affected: 3.10.4 before 3.14.9
CVE-2024-39628	8.8	0%	Aug 26	WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 3.8.6
CVE-2023-38393	8.8	1%	Jun 19	WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability Affected: through 3.6.25
CVE-2024-25572	8.8	0%	Apr 11	Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31 Affected: prior to 3.4.31
CVE-2026-65052	7.5	1%	Jul 21	Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields Affected: before 3.14.9
CVE-2026-67187 New	7.1	–	Oct 28	Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields Affected: before 3.15.4
CVE-2026-65051	6.5	0%	Jul 21	Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler Affected: before 3.14.9
CVE-2026-65050	6.5	0%	Jul 21	Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors Affected: before 3.14.9
CVE-2024-1596	6.1	0%	Sep 7	Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload Affected: through 3.3.16
CVE-2024-29220	6.1	0%	Apr 11	Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels Affected: prior to 3.8.1
CVE-2024-26019	5.4	1%	Apr 11	Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing Affected: prior to 3.8.1
CVE-2024-43999	4.8	0%	Sep 17	WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability Affected: through 3.8.11