Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

35added in the last 30 days

575new WordPress flaws this week

391,358entries in the database

224 results · page 4 of 5

Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Cross-Site Request ForgeryCVE-2024-2113 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Stored Cross-Site ScriptingCVE-2024-2108 · WordPress plugins & themes · reported by WordfenceMedium 4.6
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.8.0
What to do
Affects up to 3.8.0. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Feb 2, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Second Order SQL InjectionCVE-2024-0685 · WordPress plugins & themes · reported by WordfenceMedium 5.9
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.7.1
What to do
Affects up to 3.7.1. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org sec.stealthcopter.com
Dec 29, 2023Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-31095 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.
Product
Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.2.8
What to do
Affects up to 1.2.8. Update Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 19, 2023Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-37982 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3.
Product
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.3.3
What to do
Affects up to 1.3.3. Update Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: URL Redirection to Untrusted Site ('Open Redirect')CVE-2023-47779 · WordPress plugins & themes · reported by PatchstackMedium 4.7
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4.
Product
Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms
Affected
up to 1.1.4
What to do
Affects up to 1.1.4. Update Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Dec 7, 2023Ninja Forms Contact Form – The Drag and Drop Form Builder for: Uncontrolled Resource ConsumptionCVE-2023-35909 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
Product
Ninja Forms Contact Form – The Drag and Drop Form Builder for
Affected
up to 3.6.25
What to do
Affects up to 3.6.25. Update Ninja Forms Contact Form – The Drag and Drop Form Builder for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Nov 6, 2023WooCommerce Ninja Forms Product Add-ons: Does not validate the file to be uploadedCVE-2023-5601 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE.
Product
WooCommerce Ninja Forms Product Add-ons
Fixed in
1.7.1
What to do
Update WooCommerce Ninja Forms Product Add-ons to 1.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Product
Ninja Forms Contact Form
Fixed in
3.6.34
What to do
Update Ninja Forms Contact Form to 3.6.34 or newer.
Full record and what to do →NVD record ninjaforms.com wpscan.com
Oct 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.CVE-2023-46193 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.
Affected
up to 1.2.3
What to do
Affects up to 1.2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Aug 30, 2023Ninja Forms WordPress Ninja Forms Contact Form: Was affected by a HTML Injection security vulnerabilityCVE-2023-4109 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
Product
Ninja Forms WordPress Ninja Forms Contact Form
Fixed in
3.6.26
What to do
Update Ninja Forms WordPress Ninja Forms Contact Form to 3.6.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 11, 2023Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.CVE-2023-35773 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Danny Hearnah - ChubbyNinjaa Template Debugger plugin <= 3.1.2 versions.
Affected
up to 3.1.2
What to do
Affects up to 3.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
Affected
up to 1.2.7
Fixed in
1.2.7
What to do
Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 28, 2023A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1.CVE-2021-4336 · Other software · ITRS Group · reported by VulDBMedium 5.5
A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084.
Product
monitor-ninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 25, 2023Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.CVE-2022-47136 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
Affected
up to 4.3.4
What to do
Affects up to 4.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Ninja Forms Contact Form
Fixed in
3.6.22
What to do
Update Ninja Forms Contact Form to 3.6.22 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Product
Ninja Forms Contact Form
Fixed in
3.6.13
What to do
Update Ninja Forms Contact Form to 3.6.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 22, 2022Ninja Job Board: Does not protect the directory where it stores uploaded resumesCVE-2022-2544 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes.
Product
Ninja Job Board
Fixed in
1.3.3
What to do
Update Ninja Job Board to 1.3.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.6.10
What to do
Update Ninja Forms Contact Form to 3.6.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.6.10
What to do
Update Ninja Forms Contact Form to 3.6.10 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
Product
Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at
Affected
up to 3.6.9
What to do
Affects up to 3.6.9. Update Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com patchstack.com
Mar 23, 2022Ninja Forms - File Uploads Extension: Reflected cross-site scriptingCVE-2022-0889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
Mar 23, 2022Ninja Forms - File Uploads Extension: Arbitrary file uploadsCVE-2022-0888 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordfence.com
Feb 1, 2022Ninja Tables: Does not sanitise and escape some of its table fieldsCVE-2021-24900 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Product
Ninja Tables
Fixed in
4.1.8
What to do
Update Ninja Tables to 4.1.8 or newer.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Dec 24, 2021invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-3977 · Other software · invoiceninja · reported by security@huntr.devMedium 5.4
invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Product
invoiceninja/invoiceninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com huntr.dev
Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
Product
Ninja Forms Contact Form
Fixed in
3.6.4
What to do
Update Ninja Forms Contact Form to 3.6.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
Ninja Forms Contact Form
Fixed in
3.5.8.2
What to do
Update Ninja Forms Contact Form to 3.5.8.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
Product
Ninja Forms
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Product
Ninja Forms
Affected
up to 3.5.7
What to do
Affects up to 3.5.7. Update Ninja Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 7, 2021The Agent in NinjaRMM 5.0.909 has Insecure Permissions.CVE-2021-26274 · Other software · Ninjarmm · reported by MITREHigh 7.1
The Agent in NinjaRMM 5.0.909 has Insecure Permissions.
Product
Ninjarmm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record improsec.com ninjarmm.com
Jul 7, 2021The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.CVE-2021-26273 · Other software · Ninjarmm · reported by MITREHigh 7.8
The Agent in NinjaRMM 5.0.909 has Incorrect Access Control.
Product
Ninjarmm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record improsec.com ninjarmm.com
Jun 29, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3).CVE-2021-31516 · Other software · Vector 35 · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13670.
Product
Binary Ninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record binary.ninja zerodayinitiative.com
Jun 29, 2021This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3).CVE-2021-31515 · Other software · Vector 35 · reported by zdi-disclosures@trendmicro.comHigh 7.8
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13668.
Product
Binary Ninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record binary.ninja zerodayinitiative.com
Jun 6, 2021In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserializCVE-2021-33898 · Other software · Invoiceninja · reported by MITREHigh 8.1
In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it.
Product
Invoice Ninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Apr 5, 2021wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for: Had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connectionCVE-2021-24166 · WordPress plugins & themes · reported by WPScanMedium 5.4
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Product
wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for
Fixed in
3.4.34
What to do
Update wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · WordPress plugins & themes · reported by WPScanMedium 6.1
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
Product
Ninja Forms Contact Form
Fixed in
3.4.34
What to do
Update Ninja Forms Contact Form to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · WordPress plugins & themes · reported by WPScanMedium 4.3
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Product
Ninja Forms Contact Form
Fixed in
3.4.34.1
What to do
Update Ninja Forms Contact Form to 3.4.34.1 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Apr 5, 2021The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore makinCVE-2021-24163 · WordPress plugins & themes · reported by WPScanHigh 8.8
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
Fixed in
3.4.34
What to do
Update the plugin to 3.4.34 or newer.
Full record and what to do →NVD record wpscan.com wordfence.com
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-36174 · WordPress plugins & themes · reported by MITREMedium 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Product
Ninja Forms
Fixed in
3.4.27.1
What to do
Update Ninja Forms to 3.4.27.1 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · WordPress plugins & themes · reported by MITREMedium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Product
Ninja Forms
Fixed in
3.4.28
What to do
Update Ninja Forms to 3.4.28 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Product
ninja-forms
Fixed in
3.4.24.2
What to do
Update ninja-forms to 3.4.24.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · WordPress plugins & themes · reported by MITREMedium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format].
Affected
3.4.22 to 3.4.22
What to do
Affects 3.4.22 to 3.4.22. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record spider-security.co.uk wordpress.org
Dec 27, 2019Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers tCVE-2014-4550 · WordPress plugins & themes · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter.
Product
Shortcode Ninja
Affected
up to 1.4
What to do
Affects up to 1.4. Update Shortcode Ninja to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record codevigilant.com codevigilant.com
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
Product
ninja-forms
Fixed in
3.3.9
What to do
Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
Product
ninja-forms
Fixed in
3.2.15
What to do
Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
Product
ninja-forms
Fixed in
3.0.31
What to do
Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
Product
ninja-forms
Fixed in
3.3.21.2
What to do
Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD record wordpress.org wordpress.org
May 7, 2019Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated).CVE-2019-10869 · WordPress plugins & themes · reported by MITREHigh 8.1
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Product
Path Traversal and Unrestricted File Upload exists in the Ninja Forms
Fixed in
3.0.23
What to do
Update Path Traversal and Unrestricted File Upload exists in the Ninja Forms to 3.0.23 or newer.
Full record and what to do →NVD record wpscan.com wpvulndb.com
Feb 11, 2019_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.CVE-2019-7748 · Other software · Dbninja · reported by MITREMedium 6.1
_includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.
Product
Dbninja
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.