KS
Vendor
kstover
13
CVEs
0
On KEV
1
New 30D
Products
NF7.2
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
kstover
2 CVEs0 on KEV1 new
NF7.5
Ninja Forms – The Contact Form Builder That Grows With You
kstover
11 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90438 | NF Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder kstover | 7.2 | Oct 2 | Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission |
| CVE-2026-94504 | NF Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder kstover | 7.2 | Sep 22 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting |
| CVE-2026-11363 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 6.6 | Sep 9 | Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import |
| CVE-2026-19769 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 7.2 | Sep 5 | Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key |
| CVE-2026-15663 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 4.9 | Jul 24 | Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key |
| CVE-2026-1239 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 7.5 | Jul 1 | Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint |
| CVE-2026-1307 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 6.5 | Mar 28 | Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token |
| CVE-2026-2268 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 7.5 | Feb 10 | Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action |
| CVE-2025-11924 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 7.5 | Dec 17 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token |
| CVE-2025-10498 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 5.4 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion |
| CVE-2025-10499 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 4.3 | Sep 27 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update |
| CVE-2025-5398 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 5.4 | Jun 27 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI |
| CVE-2024-12238 | NF Ninja Forms – The Contact Form Builder That Grows With You kstover | 6.3 | Dec 29 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution |