NF
Product
Ninja Forms
57
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 39Low 0
Watch
Add Ninja Forms to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-34647 | 6.5 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in… Affected: through 3.5.7 |
| CVE-2020-36174 | 6.5 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration Affected: before 3.4.27.1 |
| CVE-2024-12238 | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Affected: before 3.8.23 |
| CVE-2024-11052 | 6.1 | Dec 12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up… Affected: before 3.8.20 |
| CVE-2024-3866 | 6.1 | Sep 25 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15… Affected: before 3.8.16 |
| CVE-2024-7354 | 6.1 | Sep 2 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS Affected: 3.8.6 before 3.8.11 |
| CVE-2024-29220 | 6.1 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels Affected: before 3.8.1 |
| CVE-2023-37979 | 6.1 | Jul 27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions Affected: before 3.6.26 |
| CVE-2023-1835 | 6.1 | May 15 | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site… Affected: before 3.6.22 |
| CVE-2021-24165 | 6.1 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect… Affected: before 3.4.34 |
| CVE-2020-12462 | 6.1 | Apr 29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS Affected: before 3.4.24.2 |
| CVE-2017-18574 | 6.1 | Aug 22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder Affected: before 3.0.31 |
| CVE-2018-19796 | 6.1 | Dec 3 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions… Affected: before 3.3.19.1 |
| CVE-2018-7280 | 6.1 | Feb 21 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS Affected: before 3.2.14 |
| CVE-2025-10498 | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Affected: before 3.12.1 |
| CVE-2025-5398 | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Affected: before 3.10.2.2 |
| CVE-2024-13470 | 5.4 | Jan 30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to,… Affected: before 3.8.25 |
| CVE-2024-26019 | 5.4 | Apr 11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing Affected: before 3.8.1 |
| CVE-2024-2108 | 5.4 | Mar 29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a… Affected: before 3.8.1 |
| CVE-2021-24166 | 5.4 | Apr 5 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it… Affected: before 3.4.34 |
| CVE-2020-8594 | 5.4 | Feb 14 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],… Affected: 3.4.22 |
| CVE-2025-14072 | 5.3 | Jan 2 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure Affected: before 3.13.3 |
| CVE-2023-35909 | 5.3 | Dec 7 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja… Affected: before 3.6.26 |
| CVE-2020-36175 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field Affected: before 3.4.27.1 |
| CVE-2020-36173 | 5.3 | Jan 6 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields Affected: before 3.4.28 |
| CVE-2025-2561 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2560 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2025-2524 | 4.8 | May 19 | Ninja Forms < 3.10.1 - Admin+ Stored XSS Affected: before 3.10.1 |
| CVE-2024-50515 | 4.8 | Nov 19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects… Affected: through 3.8.16 |
| CVE-2024-50514 | 4.8 | Nov 19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects… Affected: through 3.8.16 |
| CVE-2024-43999 | 4.8 | Sep 18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja… Affected: before 3.8.12 |
| CVE-2023-5530 | 4.8 | Nov 6 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored… Affected: before 3.6.34 |
| CVE-2021-25066 | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks… Affected: before 3.6.10 |
| CVE-2021-25056 | 4.8 | Jul 4 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even… Affected: before 3.6.10 |
| CVE-2021-36827 | 4.8 | Jun 16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label" Affected: through 3.6.9 |
| CVE-2025-10499 | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Affected: before 3.12.1 |
| CVE-2024-2113 | 4.3 | Mar 29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,… Affected: before 3.8.1 |
| CVE-2021-34648 | 4.3 | Sep 22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up… Affected: through 3.5.7 |
| CVE-2021-24164 | 4.3 | Apr 5 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the… Affected: before 3.4.34.1 |
Showing 39