NI
Vendor
Ninjaforms
64
CVEs
0
On KEV
0
New 30D
Products
NF9.8
Ninja Forms
Ninjaforms
57 CVEs0 on KEV0 new
NF9.8
Ninja Forms File Uploads
Ninjaforms
4 CVEs0 on KEV0 new
CF4.8
Contact Form
Ninjaforms
1 CVEs0 on KEV0 new
NF4.8
Ninja Forms Contact Form
Ninjaforms
1 CVEs0 on KEV0 new
NI9.8
Ninjaforms
Ninjaforms
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-14072 | NF Ninja Forms Ninjaforms | 5.3 | Jan 2 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure |
| CVE-2025-11924 | NF Ninja Forms Ninjaforms | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token |
| CVE-2025-10498 | NF Ninja Forms Ninjaforms | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion |
| CVE-2025-10499 | NF Ninja Forms Ninjaforms | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update |
| CVE-2025-9083 | NF Ninja Forms Ninjaforms | 9.8 | Sep 18 | Ninja-forms < 3.11.1 - Unauthenticated PHP Objection |
| CVE-2025-5398 | NF Ninja Forms Ninjaforms | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI |
| CVE-2025-2561 | NF Ninja Forms Ninjaforms | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS |
| CVE-2025-2560 | NF Ninja Forms Ninjaforms | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS |
| CVE-2025-2524 | NF Ninja Forms Ninjaforms | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS |
| CVE-2024-13470 | NF Ninja Forms Ninjaforms | 5.4 | Jan 30 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
| CVE-2024-12238 | NF Ninja Forms Ninjaforms | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution |
| CVE-2024-11052 | NF Ninja Forms Ninjaforms | 6.1 | Dec 12 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations |
| CVE-2024-50514 | NF Ninja Forms Ninjaforms | 4.8 | Nov 19 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-50515 | NF Ninja Forms Ninjaforms | 4.8 | Nov 19 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-3866 | NF Ninja Forms Ninjaforms | 6.1 | Sep 25 | Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer |
| CVE-2024-43999 | NF Ninja Forms Ninjaforms | 4.8 | Sep 17 | WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability |
| CVE-2024-1596 | NF Ninja Forms File Uploads Ninjaforms | 6.1 | Sep 7 | Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload |
| CVE-2024-7354 | NF Ninja Forms Ninjaforms | 6.1 | Sep 2 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS |
| CVE-2024-39628 | NF Ninja Forms Ninjaforms | 8.8 | Aug 26 | WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability |
| CVE-2024-37934 | NF Ninja Forms Ninjaforms | 9.8 | Jul 9 | WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability |
| CVE-2023-38393 | NF Ninja Forms Ninjaforms | 8.8 | Jun 19 | WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability |
| CVE-2023-38386 | NF Ninja Forms Ninjaforms | 9.8 | Jun 19 | WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability |
| CVE-2023-36505 | NF Ninja Forms Ninjaforms | 7.2 | Apr 17 | WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion |
| CVE-2024-25572 | NF Ninja Forms Ninjaforms | 8.8 | Apr 11 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31 |
| CVE-2024-26019 | NF Ninja Forms Ninjaforms | 5.4 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing |
| CVE-2024-29220 | NF Ninja Forms Ninjaforms | 6.1 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels |
| CVE-2024-2108 | NF Ninja Forms Ninjaforms | 5.4 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting |
| CVE-2024-2113 | NF Ninja Forms Ninjaforms | 4.3 | Mar 29 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export |
| CVE-2024-0685 | NF Ninja Forms Ninjaforms | 9.8 | Feb 2 | Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection |
| CVE-2023-35909 | NF Ninja Forms Ninjaforms | 5.3 | Dec 7 | WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack |
| CVE-2023-5530 | NF Ninja Forms Ninjaforms | 4.8 | Nov 6 | Ninja Forms < 3.6.34 - Admin+ Stored XSS |
| CVE-2023-4109 | NF Ninja Forms Contact Form Ninjaforms | 4.8 | Aug 30 | Ninja Forms < 3.6.26 - Admin+ Stored HTML Injection |
| CVE-2023-37979 | NF Ninja Forms Ninjaforms | 6.1 | Jul 27 | WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2023-1835 | NF Ninja Forms Ninjaforms | 6.1 | May 15 | Ninja Forms < 3.6.22 - Reflected XSS |
| CVE-2022-2903 | NF Ninja Forms Ninjaforms | 7.2 | Sep 26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import… |
| CVE-2021-25066 | NF Ninja Forms Ninjaforms | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks… |
| CVE-2021-25056 | NF Ninja Forms Ninjaforms | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even… |
| CVE-2021-36827 | NF Ninja Forms Ninjaforms | 4.8 | Jun 16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label" |
| CVE-2022-0889 | NF Ninja Forms File Uploads Ninjaforms | 6.1 | Mar 23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the… |
| CVE-2022-0888 | NF Ninja Forms File Uploads Ninjaforms | 9.8 | Mar 23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the… |
| CVE-2021-24889 | NF Ninja Forms Ninjaforms | 7.2 | Nov 29 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections… |
| CVE-2021-24381 | CF Contact Form Ninjaforms | 4.8 | Oct 25 | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users… |
| CVE-2021-34648 | NF Ninja Forms Ninjaforms | 4.3 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up… |
| CVE-2021-34647 | NF Ninja Forms Ninjaforms | 6.5 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in… |
| CVE-2021-24166 | NF Ninja Forms Ninjaforms | 5.4 | Apr 5 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it… |
| CVE-2021-24165 | NF Ninja Forms Ninjaforms | 6.1 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect… |
| CVE-2021-24164 | NF Ninja Forms Ninjaforms | 4.3 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the… |
| CVE-2021-24163 | NF Ninja Forms Ninjaforms | 8.8 | Apr 5 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for… |
| CVE-2020-36175 | NF Ninja Forms Ninjaforms | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field |
| CVE-2020-36174 | NF Ninja Forms Ninjaforms | 6.5 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration |
| CVE-2020-36173 | NF Ninja Forms Ninjaforms | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields |
| CVE-2020-12462 | NF Ninja Forms Ninjaforms | 6.1 | Apr 29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS |
| CVE-2020-8594 | NF Ninja Forms Ninjaforms | 5.4 | Feb 14 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],… |
| CVE-2018-20981 | NF Ninja Forms Ninjaforms | 9.1 | Aug 22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests |
| CVE-2018-20980 | NF Ninja Forms Ninjaforms | 7.5 | Aug 22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering |
| CVE-2017-18574 | NF Ninja Forms Ninjaforms | 6.1 | Aug 22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder |
| CVE-2019-15025 | NI Ninjaforms Ninjaforms | 9.8 | Aug 14 | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page |
| CVE-2019-10869 | NF Ninja Forms File Uploads Ninjaforms | 8.1 | May 7 | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated) |
| CVE-2018-19796 | NF Ninja Forms Ninjaforms | 6.1 | Dec 3 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions… |
| CVE-2018-16308 | NF Ninja Forms Ninjaforms | 8.6 | Sep 1 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection |