NF
Product
Ninja Forms – The Contact Form Builder That Grows With You
11
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 4Medium 7Low 0
Watch
Add Ninja Forms – The Contact Form Builder That Grows With You to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1239 | 7.5 | Jul 1 | Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint Affected: through 3.14.1 |
| CVE-2026-2268 | 7.5 | Feb 10 | Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action Affected: through 3.14.0 |
| CVE-2025-11924 | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token Affected: through 3.13.2 |
| CVE-2026-19769 | 7.2 | Sep 5 | Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key Affected: through 3.15.1 |
| CVE-2026-11363 | 6.6 | Sep 9 | Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import Affected: through 3.14.6 |
| CVE-2026-1307 | 6.5 | Mar 28 | Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token Affected: through 3.14.1 |
| CVE-2024-12238 | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: through 3.8.22 |
| CVE-2025-10498 | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Affected: through 3.12.0 |
| CVE-2025-5398 | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Affected: through 3.10.2.1 |
| CVE-2026-15663 | 4.9 | Jul 24 | Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key Affected: through 3.14.9 |
| CVE-2025-10499 | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Affected: through 3.12.0 |
Showing 11