Login Request a demo
NF
Product
Ninja Forms
by Ninjaforms · last CVE Jan 2, 2026
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities57In the news0Timeline
Severity mix
Critical 6High 10Medium 39Low 0
Severity
All severities57Critical6High10Medium39Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Ninja Forms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-39628
8.8
0%
Aug 26
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6
Affected: before 3.8.7
CVE-2023-38393
8.8
1%
Jun 19
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25
Affected: through 3.6.26
CVE-2024-25572
8.8
0%
Apr 11
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31
Affected: before 3.4.31
CVE-2021-24163
8.8
1%
Apr 5
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for…
Affected: before 3.4.34
CVE-2018-16308
8.6
2%
Sep 1
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection
Affected: before 3.3.14.1
CVE-2025-11924
7.5
0%
Dec 17
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
Affected: before 3.13.1
CVE-2018-20980
7.5
1%
Aug 22
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering
Affected: before 3.2.15
CVE-2023-36505
7.2
1%
Apr 17
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24
Affected: before 3.6.25
CVE-2022-2903
7.2
1%
Sep 26
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import…
Affected: before 3.6.13
CVE-2021-24889
7.2
1%
Nov 29
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections…
Affected: before 3.6.4
Showing 10