Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · WordPress plugins & themes · reported by VulnCheckHigh 7.1
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email addresses, and phone numbers.
- Product
- the render callback of the `ninja-forms/submissions-table` Gutenberg block that
- What to do
- Update the render callback of the `ninja-forms/submissions-table` Gutenberg block that to the newest version.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 4, 2023Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro: Does not escape a parameter before outputting it back in an attributeCVE-2023-2333 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- Product
- Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro
- Affected
- up to 1.2.7
- Fixed in
- 1.2.7
- What to do
- Update Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro to 1.2.7 or newer.
Sep 11, 2022Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable TyCVE-2022-38972 · Other software · ARK-Web co., ltd. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.
- Product
- A-Form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
- Product
- ninja-forms
- Fixed in
- 3.4.24.2
- What to do
- Update ninja-forms to 3.4.24.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Sep 20, 2019The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.CVE-2015-9402 · WordPress plugins & themes · reported by MITREHigh 8.8
The users-ultra plugin before 1.5.59 for WordPress has uultra-form-cvs-form-conf arbitrary file upload.
- Product
- users-ultra
- Fixed in
- 1.5.59
- What to do
- Update users-ultra to 1.5.59 or newer.
Full record and what to do →NVD recordseclists.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · WordPress plugins & themes · reported by MITRECritical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.
- Product
- ninja-forms
- Fixed in
- 3.3.9
- What to do
- Update ninja-forms to 3.3.9 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · WordPress plugins & themes · reported by MITREHigh 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
- Product
- ninja-forms
- Fixed in
- 3.2.15
- What to do
- Update ninja-forms to 3.2.15 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · WordPress plugins & themes · reported by MITREMedium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- Product
- ninja-forms
- Fixed in
- 3.0.31
- What to do
- Update ninja-forms to 3.0.31 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · WordPress plugins & themes · reported by MITRECritical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
- Product
- ninja-forms
- Fixed in
- 3.3.21.2
- What to do
- Update ninja-forms to 3.3.21.2 or newer.
Full record and what to do →NVD recordwordpress.orgwordpress.org
Jul 2, 2014Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-CVE-2014-4527 · WordPress plugins & themes · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in paginas/vista-previa-form.php in the EnvialoSimple: Email Marketing and Newsletters (envialosimple-email-marketing-y-newsletters-gratis) plugin before 1.98 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) FormID or (2) AdministratorID parameter.
- Fixed in
- 1.98
- What to do
- Update the plugin to 1.98 or newer.
Full record and what to do →NVD recordcodevigilant.complugins.trac.wordpress.org
Nov 3, 2011Cross-site scripting (XSS) vulnerability in the A-Form PC and PC/Mobile before 3.1 plug-ins for Movable Type allows remote attackers to inject arbitrary web scrCVE-2011-4274 · Other software · Ark-web · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the A-Form PC and PC/Mobile before 3.1 plug-ins for Movable Type allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-2676.
- Product
- A-form PC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2011The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative CVE-2011-2676 · Other software · Ark-web · reported by vultures@jpcert.or.jpMedium 5.5
The A-Form and A-Form bamboo before 1.3.6 and 2.x before 2.0.3, and A-Form PC and PC/Mobile before 3.1, plug-ins for Movable Type do not require administrative authentication, which allows remote authenticated users to modify data via unspecified vectors.
- Product
- A-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2007SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitraCVE-2007-2933 · Other software · Phil-a-form · reported by MITREHigh 7.5
SQL injection vulnerability in index.php in the Phil-a-Form (com_philaform) 1.2.0.0 and earlier component for Joomla! allows remote attackers to execute arbitrary SQL commands via the form_id parameter.
- Product
- Phil-a-form
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordosvdb.orgexchange.xforce.ibmcloud.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.