| CVE/PSC | Application | Date | Affected versions | Description |
|---|---|---|---|---|
| Actual on: Jun 21, 2026, 01:06:43 | Entries count: 117 | |||
|
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend
vulnerable
|
May 14, 2026, 10:05:27 |
Min -
Max 3.3.3
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend: from n/a through <= 3.3.2. | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Dec 10, 2025, 19:12:48 |
Min -
Max 2.0.2
|
The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve information about the system. | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Jun 13, 2026, 19:06:15 |
Min -
Max 1.2.8
|
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2. | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Jun 16, 2026, 09:06:41 |
Min -
Max 1.2.2
|
GSheetConnector For Ninja Forms [gsheetconnector-ninja-forms] < 1.2.2 WordPress Ninja Forms Google Sheet Connector plugin < 1.2.2 - Sensitive Information Disclosure vulnerability Sensitive Information Disclosure vulnerability discovered in WordPress Ninja Forms Google Sheet Connector plugin (versions < 1.2.2). | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Jun 16, 2026, 09:06:41 |
Min -
Max 1.2.2
|
GSheetConnector For Ninja Forms [gsheetconnector-ninja-forms] < 1.2.2 Unauthorised AJAX Calls via Freemius The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in admin toggle the debug mode via a CSRF attack. | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Jun 07, 2024, 01:06:45 |
Min -
Max 1.2.2
|
GSheetConnector For Ninja Forms [gsheetconnector-ninja-forms] < 1.2.2 WordPress Ninja Forms Google Sheet Connector plugin < 1.2.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability discovered in WordPress Ninja Forms Google Sheet Connector plugin (versions < 1.2.2). | |
|
Ninja Forms Google Sheet Connector
vulnerable
|
Jun 07, 2024, 01:06:45 |
Min -
Max 1.2.7
|
The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
|
vulnerable
|
Dec 11, 2025, 20:12:19 |
Min -
Max 3.5.2
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows Stored XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.5.1. | |
|
vulnerable
|
Jul 02, 2025, 23:07:16 |
Min -
Max 3.5
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4. | |
|
vulnerable
|
Nov 14, 2024, 20:11:51 |
Min -
Max 3.3.4
|
The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license function in all versions up to, and including, 3.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate u... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.11
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.11 Ninja Forms <= 2.9.10 - Cross-Site Scripting (XSS) The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Sep 01, 2024, 09:09:53 |
Min -
Max 3.8.12
|
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min 3.8.6
Max 3.8.10
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] >= 3.8.6 - <= 3.8.10 WordPress Ninja Forms Plugin 3.8.6-3.8.10 is vulnerable to Cross Site Scripting (XSS) <p>WordPress Ninja Forms Plugin 3.8.6-3.8.10 is vulnerable to Cross Site Scripting (XSS)</p><p>Software: Ninja Forms</p><p>Link: https://wordpress.org/plugins/ninja-forms/#developers</p><p>Affected Version 3.8.6-3.8.10</p><p>Fixed in version 3.8.11 </p> | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Oct 11, 2025, 02:10:33 |
Min -
Max 3.12.1
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jan 09, 2026, 22:01:19 |
Min -
Max 3.13.3
|
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Oct 11, 2025, 02:10:33 |
Min -
Max 3.12.1
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jan 09, 2026, 22:01:19 |
Min -
Max 3.13.3
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page co... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.8
|
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the form field created, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.34
|
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.4
|
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.5.8
|
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.34.1
|
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.28
|
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.27.1
|
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.23
|
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format]. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.3.19.1
|
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.3.9
|
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.5.8
|
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.34
|
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.27.1
|
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.24.2
|
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.2.15
|
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.0.31
|
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.4.34
|
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.3.21.2
|
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 2.8.10
|
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.3.18
|
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.2.14
|
The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 2.8.9
|
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.3.14
|
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min 2.9.36
Max 2.9.42
|
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.10
|
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.10
|
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label". | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.11
|
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.13
|
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.26
|
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Sep 26, 2024, 03:09:10 |
Min -
Max 3.8.16
|
The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" ... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.22
|
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jul 03, 2025, 11:07:24 |
Min -
Max 3.10.2.2
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.25
|
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.26
|
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.26
|
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.6.34
|
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.8.1
|
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as cl... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.8.1
|
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.8.1
|
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.7.2
|
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query wh... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.8.1
|
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 06, 2024, 22:06:33 |
Min -
Max 3.8.1
|
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Sep 03, 2024, 10:09:54 |
Min 3.8.6
Max 3.8.11
|
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.4.34
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.4.34 WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Cross-Site Request Forgery (CSRF) vulnerability Cross-Site Request Forgery (CSRF) vulnerability found by Chloe Chamberland in WordPress Ninja Forms Contact Form plugin (versions <= 3.4.33). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.4.34
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.4.34 WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Administrator Open Redirect vulnerability Administrator Open Redirect vulnerability found by Chloe Chamberland in WordPress Ninja Forms Contact Form plugin (versions <= 3.4.33). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
May 21, 2025, 01:05:42 |
Min -
Max 3.10.1
|
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.4.27.1
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.4.27.1 WordPress Ninja Forms plugin <= 3.4.27 - Cross-Site Request Forgery (CSRF) leading to Arbitrary Plugin Installation vulnerability Cross-Site Request Forgery (CSRF) leading to Arbitrary Plugin Installation vulnerability found by Slavco Mihajloski in WordPress Ninja Forms plugin (versions <= 3.4.27). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
May 21, 2025, 01:05:42 |
Min -
Max 3.10.1
|
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.8
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.8 WordPress Ninja Forms plugin <= 3.6.7 - Unauthenticated Email Address Disclosure vulnerability Unauthenticated Email Address Disclosure vulnerability discovered by Agence Web Coheractio in WordPress Ninja Forms plugin (versions <= 3.6.7). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
May 21, 2025, 01:05:42 |
Min -
Max 3.10.1
|
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.4.34
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.4.34 WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Authenticated OAuth Connection Key Disclosure vulnerability Authenticated OAuth Connection Key Disclosure vulnerability found by Chloe Chamberland in WordPress Ninja Forms Contact Form plugin (versions <= 3.4.33). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.4.34
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.4.34 WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure vulnerability Authenticated SendWP Plugin Installation and Client Secret Key Disclosure vulnerability found by Chloe Chamberland in WordPress Ninja Forms Contact Form plugin (versions <= 3.4.33). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Oct 31, 2024, 22:10:29 |
Min -
Max 3.8.18
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Oct 31, 2024, 22:10:29 |
Min -
Max 3.8.18
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 10, 2024, 12:06:28 |
Min -
Max 2.8.6
|
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_message’ parameter in versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.14
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.14 WordPress Ninja Forms plugin <= 3.3.13 - CSV Injection vulnerability CSV Injection vulnerability fund by Mostafa Gharzi in WordPress Ninja Forms plugin (versions <= 3.3.13). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.28
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.28 WordPress Ninja Forms Plugin <= 2.9.27 - Malicious File Export There is an unknown vulnerability in this plugin. Upgrade this plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.22
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.22 WordPress Ninja Forms Plugin <= 2.9.21 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.7.8
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.7.8 WordPress Ninja Forms Plugin - Authorization Bypass Ninja Forms plugin is prone to an authorization BYPASS vulnerability that allows an attacker to bypass security restrictions and perform unauthorized actions. Update the plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.21.3
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.21.3 WordPress Ninja Forms plugin <= 3.3.21 - Cross-Site Scripting (XSS) vulnerability Cross-Site Scripting (XSS) vulnerability found in WordPress Ninja Forms plugin (versions <= 3.3.21). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.14
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.14 WordPress Ninja Forms plugin <= 3.3.13 - Cross-Site Scripting (XSS) vulnerability Cross-Site Scripting (XSS) vulnerability found in WordPress Ninja Forms plugin (versions <= 3.3.13). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Apr 13, 2026, 17:04:30 |
Min -
Max 3.14.2
|
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to an authorization token to view form submissions for arbitrary forms, which could potentially contain sensitive information. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.52
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.52 WordPress Ninja Forms Plugin <= 2.9.51 - Multiple Cross Site Scripting Because of this vulnerability, attackers can inject malicious JavaScript code into the application. Update this plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.10
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] <= 3.6.10 WordPress Ninja Forms plugin <= 3.6.10 - Unauthenticated PHP Object Injection vulnerability Unauthenticated PHP Object Injection vulnerability discovered in WordPress Ninja Forms plugin (versions <= 3.6.10). Update the WordPress Ninja Forms plugin to the latest available version (at least 3.6.11). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.21.3
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.21.3 WordPress Ninja Forms plugin <= 3.3.21 - SQL injection (SQLi) vulnerability SQL injection (SQLi) vulnerability found in WordPress Ninja Forms plugin (versions <= 3.3.21). | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 10, 2024, 12:06:27 |
Min -
Max 3.6.26
|
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.19
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.19 WordPress Ninja Forms Plugin <= 2.9.18 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Update the plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.11
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.11 WordPress Ninja Forms Plugin <= 2.9.10 - Cross Site Scripting Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Upgrade the plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.55.2
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.55.2 WordPress Ninja Forms Plugin <= 2.9.55.1 - Authenticated SQL Injection There is a bug in this plugin. It could leak the site’s usernames and hashed passwords. Update the plugin. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.52
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.52 Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions before 2.9.52 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.8.7
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.8.7 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_message’ parameter in versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for ... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.8
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 3.6.7. This can allow unauthenticated attackers to extract sensitive data including other users' email addresses which can be used to help pe... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.0.32
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.0.32 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Arbitrary Wordpress Shortcode Injection in versions up to, and including, 3.0.31. This makes it possible for unauthenticated attackers to preview un-published forms and could possibl... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.55.2
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.55.2 Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection The Ninja Forms Contact Form plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.9.55.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for Subscriber-level attackers to append additional SQL queries into already exis... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.28
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.28 Ninja Forms Contact Form <= 2.9.27 - CSV Injection The Ninja Forms Contact Form plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 2.9.27 via the export() function. This allows authenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.22
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.22 Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.9.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into perfo... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.11
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.11 Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting The Ninja Forms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.9.10 due to insufficient input sanitization and output escaping on add_query_arg and remove_query_arg. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.19
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.19 Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting The Ninja Forms Contact Form plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.9.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthorized attackers to inject arbitrary web scripts that execute in a victim's browser. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.11
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.11 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to code injection in versions up to, and including 3.6.10 due to insufficient validation on Merge Tags that makes it possible to call arbitrary Ninja Form classes. This could lead to a variety of actions, howev... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Dec 29, 2024, 14:12:28 |
Min -
Max 3.8.23
|
The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jul 08, 2024, 14:07:29 |
Min -
Max 3.8.5
|
Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.10
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.10 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 3.6.9, due to missing nonce validation on the import_fields_listener() function that makes it p... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.14
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.14 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Scripting via the form input function in versions up to, and including, 3.3.13 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arb... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Apr 23, 2026, 11:04:35 |
Min -
Max 3.14.1
|
The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resolution of `{post_meta:KEY}` merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooCommerce billing... | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.29
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.29 Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting The Ninja Forms Contact Form plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 2.9.28 due to insufficient input sanitization and output escaping during form submission. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Apr 23, 2026, 11:04:35 |
Min -
Max 3.11.1
|
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jul 28, 2024, 03:07:08 |
Min -
Max 3.8.7
|
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 10, 2024, 12:06:28 |
Min -
Max 3.6.26
|
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.11
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.11 Ninja Forms < 3.6.11 - Unauthenticated PHP Object Injection The plugin does not validate merge tags provided in the request, which could allow unauthenticated attackers to call any static method present in the blog. One from the plugin in particular could allow for PHP Object Injection when a suitable gadget is also present on the blog. Attackers have been exploiting such issue since June 9th, 2022 | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.6.8
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.6.8 Ninja Forms < 3.6.8 - Unauthenticated Email Address Disclosure The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a form given that the file is publicly accessible, and with a guessable name | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Dec 13, 2024, 12:12:34 |
Min -
Max 3.8.20
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.28
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.28 Ninja Forms <= 2.9.27 - Malicious File Export The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Malicious File Export security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.52
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.52 Ninja Forms <= 2.9.51 - Multiple Authenticated Cross-Site Scripting (XSS) The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Multiple Authenticated Cross-Site Scripting (XSS) security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.22
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.22 Ninja Forms <= 2.9.21 - Authenticated Reflected Cross-Site Scripting (XSS) The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting (XSS) security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.5.5
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.5.5 Nina Forms < 3.5.5 - Reflected Cross-Site Scripting The plugin does not escape generated links before outputting them in attributes, leading to Reflected Cross-Site Scripting | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.14
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.14 Ninja Forms <= 3.3.13 - Cross-Site Scripting (XSS) in Import Function The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Cross-Site Scripting (XSS) in Import Function security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.55.2
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.55.2 Ninja Forms <= 2.9.55.1 - Authenticated SQL Injection The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by an Authenticated SQL Injection security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 2.9.19
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 2.9.19 Ninja Forms <= 2.9.18 - Cross-Site Scripting (XSS) The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin was affected by a Cross-Site Scripting (XSS) security vulnerability. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Jun 16, 2026, 09:06:09 |
Min -
Max 3.3.21.3
|
Ninja Forms – The Contact Form Builder That Grows With You [ninja-forms] < 3.3.21.3 Ninja Forms <= 3.3.21 - XSS and SQLi Reflected XSS vulnerability in the administrative dashboard. Blind SQL injection vulnerability in the search filter on the submissions page. | |
|
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
vulnerable
|
Feb 01, 2025, 14:02:24 |
Min -
Max 3.8.25
|
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |