Skip to content
Unknown Ninja Forms vulnerabilities
-
saturday drive ninja forms
Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
CVE-2026-67187
5.1 Medium
-
kevin stover ninja forms
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
CVE-2026-110899
Public exploit
7.1 High
-
unknown click5 crm add-on to ninja forms
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
CVE-2026-84258
8.8 High
-
unknown click5 crm add-on to ninja forms
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update
CVE-2026-84251
9.8 Critical
-
kevin stover ninja forms
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-102385
7.1 High
-
kevin stover ninja forms
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-95515
7.1 High
-
unknown ninja forms
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
CVE-2026-91827
7.5 High
-
unknown ninja forms
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
CVE-2026-92438
8.8 High
-
unknown ninja forms
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
CVE-2026-80437
4.8 Medium
-
unknown ninja forms
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
CVE-2026-80438
5.9 Medium
-
unknown ninja forms
Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
CVE-2026-15256
4.8 Medium
-
saturday drive ninja forms
Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
CVE-2026-65052
8.7 High
-
saturday drive ninja forms
Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
CVE-2026-65051
6.9 Medium
-
saturday drive ninja forms
Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors
CVE-2026-65050
7.1 High
-
saturday drive ninja forms
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
CVE-2026-65049
8.4 High
-
saturday drive ninja forms
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
CVE-2026-65048
9.3 Critical
-
ninjaforms ninja forms
Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
CVE-2025-14072
5.3 Medium
-
ninjaforms ninja forms
Ninja-forms < 3.11.1 - Unauthenticated PHP Objection
CVE-2025-9083
9.8 Critical
-
ninjaforms ninja forms
Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2025-2561
4.8 Medium
-
ninjaforms ninja forms
Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2025-2560
4.8 Medium
-
ninjaforms ninja forms
Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2025-2524
4.8 Medium
-
kevin stover ninja forms
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
CVE-2024-50514
5.9 Medium
-
kevin stover ninja forms
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
CVE-2024-50515
5.9 Medium
-
ninjaforms ninja forms
WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability
CVE-2024-43999
5.9 Medium
-
ninjaforms ninja forms
Ninja Forms 3.8.6-3.8.10 - Reflected XSS
CVE-2024-7354
6.1 Medium
-
ninjaforms ninja forms
WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2024-39628
5.4 Medium
-
ninjaforms ninja forms
WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability
CVE-2024-37934
5.4 Medium
-
ninjaforma ninja forms
WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability
CVE-2023-38393
7.6 High
-
ninjaforms ninja forms
WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability
CVE-2023-38386
7.6 High
-
ninjaforms ninja forms, saturday drive ninja forms contact form +1 more
WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion
CVE-2023-36505
6.8 Medium
-
ninjaforms ninja forms
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a...
CVE-2024-25572
8.8 High
-
ninjaforms ninja forms
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If...
CVE-2024-26019
5.4 Medium
-
ninjaforms ninja forms
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for...
CVE-2024-29220
6.1 Medium
-
ninjaforms ninja forms, saturday drive ninja forms contact form – the drag and drop form builder for wordpress +1 more
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack
CVE-2023-35909
5.3 Medium
-
atomicwebstrategy woocommerce ninja forms product add-ons
WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File Upload
CVE-2023-5601
9.8 Critical
-
ninjaforms ninja forms, unknown ninja forms contact form +1 more
Ninja Forms < 3.6.34 - Admin+ Stored XSS
CVE-2023-5530
4.8 Medium
-
ninjaforms ninja forms contact form
Ninja Forms < 3.6.26 - Admin+ Stored HTML Injection
CVE-2023-4109
4.8 Medium
-
ninjaforms ninja forms, saturday drive ninja forms contact form +1 more
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
CVE-2023-37979
Public exploit
7.1 High
-
gsheetconnector ninja forms google sheet connector, unknown gsheetconnector-ninja-forms-pro +1 more
Ninja Forms Google Sheet Connector < 1.2.7 - Reflected XSS
CVE-2023-2333
6.1 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form +1 more
Ninja Forms < 3.6.22 - Reflected XSS
CVE-2023-1835
6.1 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
NinjaForms < 3.6.13 - Admin+ PHP Objection Injection
CVE-2022-2903
7.2 High
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import
CVE-2021-25066
4.8 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting
CVE-2021-25056
4.8 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.6.4 - Admin+ SQL Injection
CVE-2021-24889
7.2 High
-
ninjaforms contact form, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
NinjaForms < 3.5.8.2 - Admin+ Stored Cross-Site Scripting
CVE-2021-24381
4.8 Medium
-
ninjaforms ninja forms
Ninja Forms <= 3.5.7 Sensitive Information Disclosure
CVE-2021-34647
6.5 Medium
-
ninjaforms ninja forms
Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection
CVE-2021-34648
6.4 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.4.34 - CSRF to OAuth Service Disconnection
CVE-2021-24166
5.4 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.4.34 - Administrator Open Redirect
CVE-2021-24165
6.1 Medium
-
ninjaforms ninja forms, unknown ninja forms contact form – the drag and drop form builder for wordpress +1 more
Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure
CVE-2021-24164
4.3 Medium
- Show olderLoading…