What’s Vulnerable › Products
kstover Ninja Forms – The Contact Form Builder That Grows With You vulnerabilities
76 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.
Latest kstover Ninja Forms – The Contact Form Builder That Grows With You vulnerabilities
- CVE-2026-110899 — WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-102385 — WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-95515 — WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- CVE-2026-92438 — Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin (CVSS 8.8)
- CVE-2026-91827 — Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export (CVSS 7.5)
- CVE-2026-11363 — Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import (CVSS 6.6)
- CVE-2026-80437 — Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags (CVSS 4.8)
- CVE-2026-19769 — Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key (CVSS 7.2)
- CVE-2026-80438 — Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API (CVSS 5.9)
- CVE-2026-15256 — Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default (CVSS 4.8)
- CVE-2026-15663 — Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key (CVSS 4.9)
- CVE-2026-65052 — Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields (CVSS 7.5)
- CVE-2026-65051 — Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler (CVSS 6.5)
- CVE-2026-65050 — Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors (CVSS 6.5)
- CVE-2026-65049 — Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action (CVSS 9.3)
- CVE-2026-65048 — Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index (CVSS 9.3)
- CVE-2026-1239 — Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint (CVSS 7.5)
- CVE-2026-1307 — Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token (CVSS 6.5)
- CVE-2026-2268 — Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action (CVSS 7.5)
- CVE-2025-14072 — Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure (CVSS 5.3)
- CVE-2025-11924 — Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token (CVSS 7.5)
- CVE-2025-10499 — Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3)
- CVE-2025-10498 — Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion (CVSS 5.4)
- CVE-2025-9083 — Ninja-forms < 3.11.1 - Unauthenticated PHP Objection (CVSS 9.8)
- CVE-2025-5398 — Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI (CVSS 5.4)