Ninjaforms / Ninja Forms
57 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2025-14072 | Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure | MEDIUM | 5.3 | Jan 2, 2026 |
| CVE-2025-11924 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via U… | HIGH | 7.5 | Dec 17, 2025 |
| CVE-2025-10498 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion | MEDIUM | 5.4 | Sep 27, 2025 |
| CVE-2025-10499 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update | MEDIUM | 4.3 | Sep 27, 2025 |
| CVE-2025-9083 | Ninja-forms < 3.11.1 - Unauthenticated PHP Objection | CRITICAL | 9.8 | Sep 18, 2025 |
| CVE-2025-5398 | Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI | MEDIUM | 6.4 | Jun 27, 2025 |
| CVE-2025-2561 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | MEDIUM | 4.8 | May 19, 2025 |
| CVE-2025-2560 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | MEDIUM | 4.8 | May 19, 2025 |
| CVE-2025-2524 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | MEDIUM | 4.8 | May 19, 2025 |
| CVE-2024-13470 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode | MEDIUM | 6.4 | Jan 30, 2025 |
| CVE-2024-12238 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution | MEDIUM | 6.3 | Dec 29, 2024 |
| CVE-2024-11052 | Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations | HIGH | 7.2 | Dec 12, 2024 |
| CVE-2024-50514 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Nov 19, 2024 |
| CVE-2024-50515 | WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Nov 19, 2024 |
| CVE-2024-3866 | Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer | MEDIUM | 6.1 | Sep 25, 2024 |
| CVE-2024-43999 | WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability | MEDIUM | 5.9 | Sep 17, 2024 |
| CVE-2024-7354 | Ninja Forms 3.8.6-3.8.10 - Reflected XSS | MEDIUM | 6.1 | Sep 2, 2024 |
| CVE-2024-39628 | WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability | HIGH | 8.8 | Aug 26, 2024 |
| CVE-2024-37934 | WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability | CRITICAL | 9.8 | Jul 9, 2024 |
| CVE-2023-38393 | WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability | HIGH | 8.8 | Jun 19, 2024 |
| CVE-2023-38386 | WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability | CRITICAL | 9.8 | Jun 19, 2024 |
| CVE-2023-36505 | WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion | HIGH | 7.2 | Apr 17, 2024 |
| CVE-2024-25572 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unin… | HIGH | 8.8 | Apr 11, 2024 |
| CVE-2024-26019 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be e… | MEDIUM | 5.4 | Apr 11, 2024 |
| CVE-2024-29220 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script m… | MEDIUM | 6.1 | Apr 11, 2024 |
Showing 1 to 25 of 57 CVEs