NF
Product
Ninja Forms
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 39Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-9083 | 9.8 | Sep 18 | Ninja-forms < 3.11.1 - Unauthenticated PHP Objection Affected: before 3.11.1 |
| CVE-2024-37934 | 9.8 | Jul 9 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4 Affected: before 3.8.5 |
| CVE-2023-38386 | 9.8 | Jun 19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25 Affected: before 3.6.26 |
| CVE-2024-0685 | 9.8 | Feb 2 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted… Affected: through 3.7.1 |
| CVE-2016-1209 | 9.8 | May 14 | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request Affected: through 2.9.42 |
| CVE-2018-20981 | 9.1 | Aug 22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests Affected: before 3.3.9 |
| CVE-2024-39628 | 8.8 | Aug 26 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6 Affected: before 3.8.7 |
| CVE-2023-38393 | 8.8 | Jun 19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25 Affected: through 3.6.26 |
| CVE-2024-25572 | 8.8 | Apr 11 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31 Affected: before 3.4.31 |
| CVE-2021-24163 | 8.8 | Apr 5 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for… Affected: before 3.4.34 |
| CVE-2018-16308 | 8.6 | Sep 1 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection Affected: before 3.3.14.1 |
| CVE-2025-11924 | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token Affected: before 3.13.1 |
| CVE-2018-20980 | 7.5 | Aug 22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering Affected: before 3.2.15 |
| CVE-2023-36505 | 7.2 | Apr 17 | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24 Affected: before 3.6.25 |
| CVE-2022-2903 | 7.2 | Sep 26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import… Affected: before 3.6.13 |
| CVE-2021-24889 | 7.2 | Nov 29 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections… Affected: before 3.6.4 |
| CVE-2021-34647 | 6.5 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in… Affected: through 3.5.7 |
| CVE-2020-36174 | 6.5 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration Affected: before 3.4.27.1 |
| CVE-2024-12238 | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: before 3.8.23 |
| CVE-2024-11052 | 6.1 | Dec 12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up… Affected: before 3.8.20 |
| CVE-2024-3866 | 6.1 | Sep 25 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15… Affected: before 3.8.16 |
| CVE-2024-7354 | 6.1 | Sep 2 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS Affected: 3.8.6 before 3.8.11 |
| CVE-2024-29220 | 6.1 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels Affected: before 3.8.1 |
| CVE-2023-37979 | 6.1 | Jul 27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions Affected: before 3.6.26 |
| CVE-2023-1835 | 6.1 | May 15 | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site… Affected: before 3.6.22 |
| CVE-2021-24165 | 6.1 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect… Affected: before 3.4.34 |
| CVE-2020-12462 | 6.1 | Apr 29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS Affected: before 3.4.24.2 |
| CVE-2017-18574 | 6.1 | Aug 22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder Affected: before 3.0.31 |
| CVE-2018-19796 | 6.1 | Dec 3 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions… Affected: before 3.3.19.1 |
| CVE-2018-7280 | 6.1 | Feb 21 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS Affected: before 3.2.14 |
| CVE-2025-10498 | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Affected: before 3.12.1 |
| CVE-2025-5398 | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Affected: before 3.10.2.2 |
| CVE-2024-13470 | 5.4 | Jan 30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to,… Affected: before 3.8.25 |
| CVE-2024-26019 | 5.4 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing Affected: before 3.8.1 |
| CVE-2024-2108 | 5.4 | Mar 29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a… Affected: before 3.8.1 |
| CVE-2021-24166 | 5.4 | Apr 5 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it… Affected: before 3.4.34 |
| CVE-2020-8594 | 5.4 | Feb 14 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],… Affected: 3.4.22 |
| CVE-2025-14072 | 5.3 | Jan 2 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure Affected: before 3.13.3 |
| CVE-2023-35909 | 5.3 | Dec 7 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja… Affected: before 3.6.26 |
| CVE-2020-36175 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field Affected: before 3.4.27.1 |
| CVE-2020-36173 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields Affected: before 3.4.28 |
| CVE-2025-2561 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2560 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2524 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2024-50515 | 4.8 | Nov 19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects… Affected: through 3.8.16 |
| CVE-2024-50514 | 4.8 | Nov 19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects… Affected: through 3.8.16 |
| CVE-2024-43999 | 4.8 | Sep 18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja… Affected: before 3.8.12 |
| CVE-2023-5530 | 4.8 | Nov 6 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored… Affected: before 3.6.34 |
| CVE-2021-25066 | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks… Affected: before 3.6.10 |
| CVE-2021-25056 | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even… Affected: before 3.6.10 |