Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?ninja-formsNinja Forms - File UploadsNinja Forms - Excel ExportPopup addon for Ninja Formsclick5 CRM add-on to Ninja Formsninja-forms-styleNinja Forms Views – Display & Edit Ninja Forms Submissions on your site frontendStyler for Ninja Forms
Plugin · ninja-forms
ninja-forms
77 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 28, 2026Ninja Forms: Incomplete server-side validationCVE-2026-67187 · fixed in 3.15.4 · reported by VulnCheckMedium 5.1
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF_Abstracts_List falls through to a validate() method that only checks required-field presence. Attackers can submit crafted formula payloads through the unauthenticated nf_ajax_submit endpoint that bypass CSV escaping applied only to Textbox and Textarea fields, resulting in CSV injection when an administrator downloads and opens the exported submissions file.
Oct 21, 2026Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110899 · affects up to 3.15.5 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5.
Oct 2, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-90438 · affects up to 3.15.4 · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-102385 · affects up to 3.15.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-95515 · affects up to 3.15.3 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Sep 22, 2026Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor.CVE-2026-94504 · reported by WordfenceHigh 7.2
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 9, 2026Ninja Forms – The Contact Form Builder That Grows With You: PHP Object InjectionCVE-2026-11363 · affects up to 3.14.6 · reported by WordfenceMedium 6.6
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 5, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-19769 · affects up to 3.15.1 · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 4, 2026Ninja Forms: Does not restrict its REST abilities to administratorsCVE-2026-80438 · fixed in 3.15.2 · reported by WPScanMedium 5.9
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
Aug 6, 2026Ninja Forms: Does not prevent user-supplied query-string inputCVE-2026-15256 · fixed in 3.14.10 · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.
Jul 24, 2026Ninja Forms – The Contact Form Builder That Grows With You: Generic SQL InjectionCVE-2026-15663 · affects up to 3.14.9 · reported by WordfenceMedium 4.9
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the 'settings' object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrCVE-2026-65052 · reported by VulnCheckHigh 8.7
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · reported by VulnCheckMedium 6.9
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · reported by VulnCheckHigh 7.1
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
Jul 21, 2026Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to triCVE-2026-65049 · reported by VulnCheckHigh 8.4
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or network-admin privileges.
Jul 21, 2026Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable FieldsetCVE-2026-65048 · affects up to 3.14.9 · reported by VulnCheckCritical 9.3
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site content.
Jul 1, 2026Ninja Forms – The Contact Form Builder That Grows With You: Unauthorized access of dataCVE-2026-1239 · affects up to 3.14.1 · reported by WordfenceHigh 7.5
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.
Mar 28, 2026Ninja Forms - The Contact Form Builder That Grows With You: Sensitive Information ExposureCVE-2026-1307 · affects up to 3.14.1 · reported by WordfenceMedium 6.5
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to an authorization token to view form submissions for arbitrary forms, which could potentially contain sensitive information.
Feb 10, 2026Ninja Forms: Sensitive Information ExposureCVE-2026-2268 · affects up to 3.14.0 · reported by WordfenceHigh 7.5
The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resolution of `{post_meta:KEY}` merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information via the `nf_ajax_submit` AJAX action.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 2, 2026Ninja Forms: Allows unauthenticated attackers to generate valid access tokens via the REST APICVE-2025-14072 · fixed in 3.13.3 · reported by WPScanMedium 5.3
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
Dec 17, 2025Ninja Forms – The Contact Form Builder That Grows With You: Insecure Direct Object ReferenceCVE-2025-11924 · affects up to 3.13.2 · reported by WordfenceHigh 7.5
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10499 · affects up to 3.12.0 · reported by WordfenceMedium 4.3
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10498 · affects up to 3.12.0 · reported by WordfenceMedium 4.3
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 18, 2025Ninja Forms: Unserializes user input via form fieldCVE-2025-9083 · fixed in 3.11.1 · reported by WPScanCritical 9.8
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Jun 27, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2025-5398 · affects up to 3.10.2.1 · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · fixed in 3.10.1 · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · fixed in 3.10.1 · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2524 · fixed in 3.10.1 · reported by WPScanMedium 4.8
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Jan 30, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-13470 · affects up to 3.8.24 · reported by WordfenceMedium 6.4
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 29, 2024The Ninja Forms – The Contact Form Builder That Grows With You: Arbitrary shortcode executionCVE-2024-12238 · affects up to 3.8.22 · reported by WordfenceMedium 6.3
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Dec 12, 2024Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-11052 · affects up to 3.8.19 · reported by WordfenceHigh 7.2
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · affects up to 3.8.16 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50514 · affects up to 3.8.16 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
Sep 25, 2024Ninja Forms Contact Form: Reflected Self-Based Cross-Site ScriptingCVE-2024-3866 · affects up to 3.8.15 · reported by WordfenceMedium 4.7
The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" for a targeted form to be enabled. However, there is no setting available to the attacker or even an administrator-level user to enable this mode. The mode is only enabled during a required update, which is a very short window of time. Additionally, because of the self-based nature of this vulnerability, attackers would have to rely on additional techniques to execute a supplied payload in the context of targeted user.
Sep 17, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43999 · affects up to 3.8.11 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.
Sep 2, 2024Ninja Forms: Does not escape an URL before outputting it back in an attributeCVE-2024-7354 · fixed in 3.8.11 · reported by WPScanMedium 6.1
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Aug 26, 2024Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2024-39628 · affects up to 3.8.6 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
Jul 9, 2024Ninja Forms: Improper Control of Generation of Code ('Code Injection')CVE-2024-37934 · affects up to 3.8.4 · reported by PatchstackMedium 5.4
Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38393 · affects up to 3.6.25 · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38386 · affects up to 3.6.25 · reported by PatchstackHigh 7.6
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Apr 17, 2024Ninja Forms Contact Form: Improper Input ValidationCVE-2023-36505 · affects up to 3.6.24 · reported by PatchstackMedium 6.8
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
Apr 10, 2024custom fields for labels: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-29220 · fixed in 3.8.1 · reported by vultures@jpcert.or.jpMedium 6.1
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Apr 10, 2024submit processing: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-26019 · fixed in 3.8.1 · reported by vultures@jpcert.or.jpMedium 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Apr 10, 2024Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.CVE-2024-25572 · fixed in 3.4.31 · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Cross-Site Request ForgeryCVE-2024-2113 · affects up to 3.8.0 · reported by WordfenceMedium 4.3
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Stored Cross-Site ScriptingCVE-2024-2108 · affects up to 3.8.0 · reported by WordfenceMedium 4.6
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Feb 2, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Second Order SQL InjectionCVE-2024-0685 · affects up to 3.7.1 · reported by WordfenceMedium 5.9
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
Dec 7, 2023Ninja Forms Contact Form – The Drag and Drop Form Builder for: Uncontrolled Resource ConsumptionCVE-2023-35909 · affects up to 3.6.25 · reported by PatchstackMedium 5.3
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · fixed in 3.6.34 · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Jul 27, 2023Unauth.CVE-2023-37979 · fixed in 3.6.26 · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.
May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · fixed in 3.6.22 · reported by WPScanMedium 6.1
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · fixed in 3.6.13 · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · fixed in 3.6.10 · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · fixed in 3.6.10 · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · affects up to 3.6.9 · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · fixed in 3.6.4 · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · fixed in 3.5.8.2 · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · affects up to 3.5.7 · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · affects up to 3.5.7 · reported by WordfenceMedium 6.5
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · fixed in 3.4.34 · reported by WPScanMedium 6.1
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · fixed in 3.4.34.1 · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · fixed in 3.4.27.1 · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-36174 · fixed in 3.4.27.1 · reported by MITREMedium 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · fixed in 3.4.28 · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · fixed in 3.4.24.2 · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · affects 3.4.22 to 3.4.22 · reported by MITREMedium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · fixed in 3.3.9 · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · fixed in 3.2.15 · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · fixed in 3.0.31 · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · fixed in 3.3.21.2 · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Dec 3, 2018An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.pCVE-2018-19796 · fixed in 3.3.19.1 · reported by MITREMedium 6.1
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter.
Nov 15, 2018XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submisCVE-2018-19287 · fixed in 3.3.18 · reported by MITREMedium 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
Sep 1, 2018The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.CVE-2018-16308 · fixed in 3.3.14.1 · reported by MITREHigh 8.6
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
Feb 21, 2018The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-7280 · fixed in 3.2.14 · reported by MITREMedium 6.1
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · fixed in 2.9.42.1 · reported by vultures@jpcert.or.jpCritical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request.
Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scriCVE-2015-2220 · fixed in 2.8.9 · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.
Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · fixed in 2.8.10 · reported by MITREHigh 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.