Ninjaforms Ninja_forms
57 CVEs affecting Ninjaforms Ninja_forms. Latest disclosed: 2026-01-02. Critical: 3, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9083 | Critical | 9.8 | 2025-09-18 | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection… |
CVE-2016-1209 | Critical | 9.8 | 2016-05-14 | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST re… |
CVE-2018-20981 | Critical | 9.1 | 2019-08-22 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. |
CVE-2024-25572 | High | 8.8 | 2024-04-11 | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unin… |
CVE-2021-24163 | High | 8.8 | 2021-04-05 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore maki… |
CVE-2018-16308 | High | 8.6 | 2018-09-01 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. |
CVE-2023-38393 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2023-38386 | High | 7.6 | 2024-06-19 | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
CVE-2025-11924 | High | 7.5 | 2025-12-17 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in… |
CVE-2018-20980 | High | 7.5 | 2019-08-22 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. |
CVE-2024-11052 | High | 7.2 | 2024-12-12 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter… |
CVE-2022-2903 | High | 7.2 | 2022-09-26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when… |
CVE-2021-24889 | High | 7.2 | 2021-11-29 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform… |
CVE-2023-37979 | High | 7.1 | 2023-07-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions. |
CVE-2023-36505 | Medium | 6.8 | 2024-04-17 | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. |
CVE-2021-34647 | Medium | 6.5 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Subm… |
CVE-2020-36174 | Medium | 6.5 | 2021-01-06 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. |
CVE-2025-5398 | Medium | 6.4 | 2025-06-27 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating en… |
CVE-2024-13470 | Medium | 6.4 | 2025-01-30 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in… |
CVE-2021-34648 | Medium | 6.4 | 2021-09-22 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php… |