NF
Product
Ninja Forms
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 8Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-9083 | 9.8 | Sep 18 | Ninja-forms < 3.11.1 - Unauthenticated PHP Objection Affected: before 3.11.1 |
| CVE-2026-92438 | 8.8 | Sep 22 | Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin Affected: 3.15.3 before 3.15.4 |
| CVE-2026-91827 | 7.5 | Sep 22 | Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export Affected: 3.15.3 before 3.15.4 |
| CVE-2024-7354 | 6.1 | Sep 2 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS Affected: 3.8.6 before 3.8.11 |
| CVE-2026-80438 | 5.9 | Sep 4 | Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API Affected: 3.14.0 before 3.15.2 |
| CVE-2025-14072 | 5.3 | Jan 2 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure Affected: before 3.13.3 |
| CVE-2026-80437 | 4.8 | Sep 6 | Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags Affected: 3.14.10 before 3.15.2 |
| CVE-2026-15256 | 4.8 | Aug 6 | Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default Affected: before 3.14.10 |
| CVE-2025-2561 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2560 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2524 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
Showing 11