NF
Product
Ninja Forms
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 39Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-36827 | 4.8 | Jun 16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label" Affected: through 3.6.9 |
| CVE-2025-10499 | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Affected: before 3.12.1 |
| CVE-2024-2113 | 4.3 | Mar 29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… Affected: before 3.8.1 |
| CVE-2021-34648 | 4.3 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up… Affected: through 3.5.7 |
| CVE-2021-24164 | 4.3 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the… Affected: before 3.4.34.1 |
| CVE-2015-2220 | – | Mar 5 | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the… Affected: through 2.8.8 |
| CVE-2014-9688 | – | Mar 5 | Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users Affected: through 2.8.9 |