CVE-2025-14072 | Medium | 5.3 | 2026-01-02 | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to rea… |
CVE-2025-11924 | High | 7.5 | 2025-12-17 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in… |
CVE-2025-10499 | Medium | 4.3 | 2025-09-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2025-10498 | Medium | 4.3 | 2025-09-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… |
CVE-2025-9083 | Critical | 9.8 | 2025-09-18 | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection… |
CVE-2025-5398 | Medium | 6.4 | 2025-06-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating en… |
CVE-2025-2561 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2560 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-2524 | Medium | 4.8 | 2025-05-19 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2024-13470 | Medium | 6.4 | 2025-01-30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in… |
CVE-2024-12238 | Medium | 6.3 | 2024-12-29 | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, a… |
CVE-2024-11052 | High | 7.2 | 2024-12-12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter… |
CVE-2024-50515 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.Th… |
CVE-2024-50514 | Medium | 5.9 | 2024-11-19 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.Th… |
CVE-2024-3866 | Medium | 4.7 | 2024-09-25 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, an… |
CVE-2024-43999 | Medium | 5.9 | 2024-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This… |
CVE-2024-1596 | High | 7.2 | 2024-09-07 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, an… |
CVE-2024-7354 | Medium | 6.1 | 2024-09-02 | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting w… |
CVE-2024-39628 | Medium | 5.4 | 2024-08-26 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a throug… |
CVE-2024-37934 | Medium | 5.4 | 2024-07-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: fro… |
CVE-2023-38393 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2023-38386 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2023-36505 | Medium | 6.8 | 2024-04-17 | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. |
CVE-2024-29220 | Medium | 6.1 | 2024-04-11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script m… |
CVE-2024-26019 | Medium | 5.4 | 2024-04-11 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be e… |
CVE-2024-25572 | High | 8.8 | 2024-04-11 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unin… |
CVE-2024-2113 | Medium | 4.3 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up… |
CVE-2024-2108 | Medium | 4.6 | 2024-03-29 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image titl… |
CVE-2024-0685 | Medium | 5.9 | 2024-02-02 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email addr… |
CVE-2023-35909 | Medium | 5.3 | 2023-12-07 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This i… |
CVE-2023-5530 | Medium | 4.8 | 2023-11-06 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin… |
CVE-2023-4109 | Medium | 4.8 | 2023-08-30 | The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability. |
CVE-2023-37979 | High | 7.1 | 2023-07-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions. |
CVE-2023-1835 | Medium | 6.1 | 2023-05-15 | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflec… |
CVE-2022-2903 | High | 7.2 | 2022-09-26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when… |
CVE-2021-25066 | Medium | 4.8 | 2022-07-04 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Sit… |
CVE-2021-25056 | Medium | 4.8 | 2022-07-04 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scri… |
CVE-2021-36827 | Medium | 4.8 | 2022-06-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label". |
CVE-2022-0889 | High | 7.2 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename par… |
CVE-2022-0888 | Critical | 9.8 | 2022-03-23 | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~… |
CVE-2021-24889 | High | 7.2 | 2021-11-29 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform… |
CVE-2021-24381 | Medium | 4.8 | 2021-10-25 | The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow hi… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2021-24166 | Medium | 5.4 | 2021-04-05 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce pr… |
CVE-2021-24165 | Medium | 6.1 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a us… |
CVE-2021-24164 | Medium | 4.3 | 2021-04-05 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and… |
CVE-2021-24163 | High | 8.8 | 2021-04-05 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore maki… |
CVE-2020-36175 | Medium | 5.3 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. |
CVE-2020-36174 | Medium | 6.5 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. |
CVE-2020-36173 | Medium | 5.3 | 2021-01-06 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. |
CVE-2020-12462 | Medium | 6.1 | 2020-04-29 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. |
CVE-2020-8594 | Medium | 5.4 | 2020-02-14 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], nin… |
CVE-2018-20981 | Critical | 9.1 | 2019-08-22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. |
CVE-2018-20980 | High | 7.5 | 2019-08-22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. |
CVE-2017-18574 | Medium | 6.1 | 2019-08-22 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. |
CVE-2019-15025 | Critical | 9.8 | 2019-08-14 | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. |
CVE-2019-10869 | High | 8.1 | 2019-05-07 | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an… |
CVE-2018-19796 | Medium | 6.1 | 2018-12-03 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing… |
CVE-2018-16308 | High | 8.6 | 2018-09-01 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. |
CVE-2018-7280 | Medium | 6.1 | 2018-02-21 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. |
CVE-2016-1209 | Critical | 9.8 | 2016-05-14 | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST re… |
CVE-2015-2220 | | | 2015-03-05 | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scr… |
CVE-2014-9688 | | | 2015-03-05 | Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users. |