Login Request a demo
NI
Vendor
Ninjaforms
5 products with CVEs on record
64
CVEs
0
On KEV
0
New 30D
Products
NF
Ninja Forms
Ninjaforms
9.8
57 CVEs0 on KEV0 new
NF
Ninja Forms File Uploads
Ninjaforms
9.8
4 CVEs0 on KEV0 new
CF
Contact Form
Ninjaforms
4.8
1 CVEs0 on KEV0 new
NF
Ninja Forms Contact Form
Ninjaforms
4.8
1 CVEs0 on KEV0 new
NI
Ninjaforms
Ninjaforms
9.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2025-14072
NF
Ninja Forms
Ninjaforms
5.3
0%
Jan 2Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
CVE-2025-11924
NF
Ninja Forms
Ninjaforms
7.5
0%
Dec 17Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
CVE-2025-10498
NF
Ninja Forms
Ninjaforms
5.4
0%
Sep 27Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
CVE-2025-10499
NF
Ninja Forms
Ninjaforms
4.3
0%
Sep 27Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
CVE-2025-9083
NF
Ninja Forms
Ninjaforms
9.8
1%
Sep 18Ninja-forms < 3.11.1 - Unauthenticated PHP Objection
CVE-2025-5398
NF
Ninja Forms
Ninjaforms
5.4
0%
Jun 27Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
CVE-2025-2561
NF
Ninja Forms
Ninjaforms
4.8
0%
May 19Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2025-2560
NF
Ninja Forms
Ninjaforms
4.8
0%
May 19Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2025-2524
NF
Ninja Forms
Ninjaforms
4.8
0%
May 19Ninja Forms < 3.10.1 - Admin+ Stored XSS
CVE-2024-13470
NF
Ninja Forms
Ninjaforms
5.4
0%
Jan 30The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to,…
CVE-2024-12238
NF
Ninja Forms
Ninjaforms
6.3
0%
Dec 29Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
CVE-2024-11052
NF
Ninja Forms
Ninjaforms
6.1
0%
Dec 12The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up…
CVE-2024-50515
NF
Ninja Forms
Ninjaforms
4.8
0%
Nov 19Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects…
CVE-2024-50514
NF
Ninja Forms
Ninjaforms
4.8
0%
Nov 19Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects…
CVE-2024-3866
NF
Ninja Forms
Ninjaforms
6.1
0%
Sep 25The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15…
CVE-2024-43999
NF
Ninja Forms
Ninjaforms
4.8
0%
Sep 18Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja…
CVE-2024-1596
NF
Ninja Forms File Uploads
Ninjaforms
6.1
0%
Sep 7Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
CVE-2024-7354
NF
Ninja Forms
Ninjaforms
6.1
1%
Sep 2Ninja Forms 3.8.6-3.8.10 - Reflected XSS
CVE-2024-39628
NF
Ninja Forms
Ninjaforms
8.8
0%
Aug 26Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6
CVE-2024-37934
NF
Ninja Forms
Ninjaforms
9.8
0%
Jul 9Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4
CVE-2023-38393
NF
Ninja Forms
Ninjaforms
8.8
1%
Jun 19Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25
CVE-2023-38386
NF
Ninja Forms
Ninjaforms
9.8
0%
Jun 19Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25
CVE-2023-36505
NF
Ninja Forms
Ninjaforms
7.2
1%
Apr 17Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24
CVE-2024-29220
NF
Ninja Forms
Ninjaforms
6.1
0%
Apr 11Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels
CVE-2024-26019
NF
Ninja Forms
Ninjaforms
5.4
1%
Apr 11Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing
CVE-2024-25572
NF
Ninja Forms
Ninjaforms
8.8
0%
Apr 11Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31
CVE-2024-2113
NF
Ninja Forms
Ninjaforms
4.3
0%
Mar 29The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,…
CVE-2024-2108
NF
Ninja Forms
Ninjaforms
5.4
0%
Mar 29The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a…
CVE-2024-0685
NF
Ninja Forms
Ninjaforms
9.8
1%
Feb 2The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted…
CVE-2023-35909
NF
Ninja Forms
Ninjaforms
5.3
1%
Dec 7Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja…
CVE-2023-5530
NF
Ninja Forms
Ninjaforms
4.8
1%
Nov 6The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored…
CVE-2023-4109
NF
Ninja Forms Contact Form
Ninjaforms
4.8
0%
Aug 30The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability
CVE-2023-37979
NF
Ninja Forms
Ninjaforms
6.1
10%
Jul 27Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions
CVE-2023-1835
NF
Ninja Forms
Ninjaforms
6.1
1%
May 15The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site…
CVE-2022-2903
NF
Ninja Forms
Ninjaforms
7.2
1%
Sep 26The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import…
CVE-2021-25066
NF
Ninja Forms
Ninjaforms
4.8
1%
Jul 4The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks…
CVE-2021-25056
NF
Ninja Forms
Ninjaforms
4.8
1%
Jul 4The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even…
CVE-2021-36827
NF
Ninja Forms
Ninjaforms
4.8
1%
Jun 16Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label"
CVE-2022-0889
NF
Ninja Forms File Uploads
Ninjaforms
6.1
1%
Mar 23The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the…
CVE-2022-0888
NF
Ninja Forms File Uploads
Ninjaforms
9.8
39%
Mar 23The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the…
CVE-2021-24889
NF
Ninja Forms
Ninjaforms
7.2
1%
Nov 29The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections…
CVE-2021-24381
CF
Contact Form
Ninjaforms
4.8
1%
Oct 25The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users…
CVE-2021-34648
NF
Ninja Forms
Ninjaforms
4.3
1%
Sep 22The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up…
CVE-2021-34647
NF
Ninja Forms
Ninjaforms
6.5
1%
Sep 22The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in…
CVE-2021-24166
NF
Ninja Forms
Ninjaforms
5.4
0%
Apr 5The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it…
CVE-2021-24165
NF
Ninja Forms
Ninjaforms
6.1
2%
Apr 5In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect…
CVE-2021-24164
NF
Ninja Forms
Ninjaforms
4.3
1%
Apr 5In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the…
CVE-2021-24163
NF
Ninja Forms
Ninjaforms
8.8
1%
Apr 5The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for…
CVE-2020-36175
NF
Ninja Forms
Ninjaforms
5.3
1%
Jan 6The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field
CVE-2020-36174
NF
Ninja Forms
Ninjaforms
6.5
1%
Jan 6The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration
CVE-2020-36173
NF
Ninja Forms
Ninjaforms
5.3
1%
Jan 6The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields
CVE-2020-12462
NF
Ninja Forms
Ninjaforms
6.1
0%
Apr 29The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS
CVE-2020-8594
NF
Ninja Forms
Ninjaforms
5.4
1%
Feb 14The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key],…
CVE-2018-20981
NF
Ninja Forms
Ninjaforms
9.1
2%
Aug 22The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests
CVE-2018-20980
NF
Ninja Forms
Ninjaforms
7.5
1%
Aug 22The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering
CVE-2017-18574
NF
Ninja Forms
Ninjaforms
6.1
1%
Aug 22The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder
CVE-2019-15025
NI
Ninjaforms
Ninjaforms
9.8
2%
Aug 14The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page
CVE-2019-10869
NF
Ninja Forms File Uploads
Ninjaforms
8.1
8%
May 7Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated)
CVE-2018-19796
NF
Ninja Forms
Ninjaforms
6.1
2%
Dec 3An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions…
CVE-2018-16308
NF
Ninja Forms
Ninjaforms
8.6
2%
Sep 1The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection