Ninja Forms
by WordPress
Source repositories
CVEs (64)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-5398 | Med | 0.42 | 6.4 | 0.00 | Jun 27, 2025 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through… | ||
| CVE-2024-13470 | Med | 0.42 | 6.4 | 0.00 | Jan 30, 2025 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied… | ||
| CVE-2021-34648 | Med | 0.42 | 6.4 | 0.01 | Sep 22, 2021 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the… | ||
| CVE-2021-34647 | Med | 0.42 | 6.5 | 0.01 | Sep 22, 2021 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms… | ||
| CVE-2020-36174 | Med | 0.42 | 6.5 | 0.01 | Jan 6, 2021 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | ||
| CVE-2024-12238 | Med | 0.41 | 6.3 | 0.00 | Dec 29, 2024 | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate… | ||
| CVE-2026-19769 | Hig | 0.40 | 7.2 | 0.00 | Sep 5, 2026 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and… | ||
| CVE-2024-7354 | Med | 0.40 | 6.1 | 0.01 | Sep 2, 2024 | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||
| CVE-2024-29220 | Med | 0.40 | 6.1 | 0.00 | Apr 11, 2024 | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. | ||
| CVE-2020-12462 | Med | 0.40 | 6.1 | 0.00 | Apr 29, 2020 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | ||
| CVE-2017-18574 | Med | 0.40 | 6.1 | 0.01 | Aug 22, 2019 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | ||
| CVE-2018-7280 | Med | 0.40 | 6.1 | 0.01 | Feb 21, 2018 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | ||
| CVE-2026-80438 | Med | 0.38 | 5.9 | 0.00 | Sep 4, 2026 | The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read… | ||
| CVE-2024-50515 | Med | 0.38 | 5.9 | 0.00 | Nov 19, 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. | ||
| CVE-2024-50514 | Med | 0.38 | 5.9 | 0.00 | Nov 19, 2024 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. | ||
| CVE-2024-43999 | Med | 0.38 | 5.9 | 0.00 | Sep 18, 2024 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11. | ||
| CVE-2018-19287 | Med | 0.36 | 6.1 | 0.09 | Nov 15, 2018 | XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter. | ||
| CVE-2026-1307 | Med | 0.35 | 6.5 | 0.00 | Mar 28, 2026 | The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This… | ||
| CVE-2024-39628 | Med | 0.35 | 5.4 | 0.00 | Aug 26, 2024 | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6. | ||
| CVE-2024-37934 | Med | 0.35 | 5.4 | 0.00 | Jul 9, 2024 | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4. |
- risk 0.42cvss 6.4epss 0.00
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through…
- risk 0.42cvss 6.4epss 0.00
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied…
- risk 0.42cvss 6.4epss 0.01
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the…
- risk 0.42cvss 6.5epss 0.01
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms…
- risk 0.42cvss 6.5epss 0.01
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
- risk 0.41cvss 6.3epss 0.00
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate…
- risk 0.40cvss 7.2epss 0.00
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and…
- risk 0.40cvss 6.1epss 0.01
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- risk 0.40cvss 6.1epss 0.00
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
- risk 0.40cvss 6.1epss 0.00
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
- risk 0.40cvss 6.1epss 0.01
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- risk 0.40cvss 6.1epss 0.01
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- risk 0.38cvss 5.9epss 0.00
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read…
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16.
- risk 0.38cvss 5.9epss 0.00
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.
- risk 0.36cvss 6.1epss 0.09
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter.
- risk 0.35cvss 6.5epss 0.00
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This…
- risk 0.35cvss 5.4epss 0.00
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.
- risk 0.35cvss 5.4epss 0.00
Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.
Page 2 of 4