Skip to content
Noroxi

ninjaforms records

64 published records for vendor ninjaforms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
1 · 1.6%
Pre-auth RCE
2
With a fix record
26.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

64 records
  • CVE-2016-1209
    57Plan

    The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized

    CriticalCVSS 9.8WeaponizedEPSS 62%

    ninjaforms · ninja formsMay 14, 2016

  • CVE-2022-0888
    51Plan

    Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload

    CriticalCVSS 9.8No exploitEPSS 39%

    ninjaforms · ninja forms file uploadsMar 23, 2022

  • CVE-2019-15025
    40Plan

    The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.

    CriticalCVSS 9.8No exploitEPSS 2%

    ninjaforms · ninjaformsAug 14, 2019

  • CVE-2024-0685
    39Monitor

    Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection

    CriticalCVSS 9.8No exploitEPSS 1%

    ninjaforms · ninja formsFeb 2, 2024

  • CVE-2025-9083
    39Monitor

    Ninja-forms < 3.11.1 - Unauthenticated PHP Objection

    CriticalCVSS 9.8No exploitEPSS 1%

    ninjaforms · ninja formsSep 18, 2025

  • CVE-2023-38386
    39Monitor

    WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    ninjaforms · ninja formsJun 19, 2024

  • CVE-2024-37934
    39Monitor

    WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    ninjaforms · ninja formsJul 9, 2024

  • CVE-2018-20981
    37Monitor

    The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req

    CriticalCVSS 9.1No exploitEPSS 2%

    ninjaforms · ninja formsAug 22, 2019

  • CVE-2018-16308
    35Monitor

    The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.

    HighCVSS 8.6No exploitEPSS 2%

    ninjaforms · ninja formsSep 1, 2018

  • CVE-2021-24163
    35Monitor

    Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

    HighCVSS 8.8No exploitEPSS 1%

    ninjaforms · ninja formsApr 5, 2021

  • CVE-2023-38393
    35Monitor

    WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    ninjaforms · ninja formsJun 19, 2024

  • CVE-2024-25572
    35Monitor

    Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.

    HighCVSS 8.8No exploitEPSS 0%

    ninjaforms · ninja formsApr 10, 2024

  • CVE-2024-39628
    35Monitor

    WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    ninjaforms · ninja formsAug 26, 2024

  • CVE-2019-10869
    34Monitor

    Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activat

    HighCVSS 8.1Proof of conceptEPSS 8%

    ninjaforms · ninja forms file uploadsMay 7, 2019

  • CVE-2014-9688
    31Monitor

    Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi

    HighCVSS 7.5No exploitEPSS 2%

    ninjaforms · ninja formsMar 5, 2015

  • CVE-2018-20980
    30Monitor

    The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.

    HighCVSS 7.5No exploitEPSS 1%

    ninjaforms · ninja formsAug 22, 2019

  • CVE-2025-11924
    30Monitor

    Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Un

    HighCVSS 7.5No exploitEPSS 0%

    ninjaforms · ninja formsDec 17, 2025

  • CVE-2022-2903
    28Monitor

    NinjaForms < 3.6.13 - Admin+ PHP Objection Injection

    HighCVSS 7.2No exploitEPSS 1%

    ninjaforms · ninja formsSep 26, 2022

  • CVE-2021-24889
    28Monitor

    Ninja Forms < 3.6.4 - Admin+ SQL Injection

    HighCVSS 7.2No exploitEPSS 1%

    ninjaforms · ninja formsNov 29, 2021

  • CVE-2023-36505
    28Monitor

    WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion

    HighCVSS 7.2No exploitEPSS 1%

    ninjaforms · ninja formsApr 17, 2024

  • CVE-2023-37979
    27Monitor

    WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 10%

    ninjaforms · ninja formsJul 27, 2023

  • CVE-2021-34647
    26Monitor

    Ninja Forms <= 3.5.7 Sensitive Information Disclosure

    MediumCVSS 6.5No exploitEPSS 1%

    ninjaforms · ninja formsSep 22, 2021

  • CVE-2020-36174
    26Monitor

    The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.

    MediumCVSS 6.5No exploitEPSS 1%

    ninjaforms · ninja formsJan 6, 2021

  • CVE-2024-12238
    25Monitor

    Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

    MediumCVSS 6.3No exploitEPSS 0%

    ninjaforms · ninja formsDec 29, 2024

  • CVE-2021-24165
    24Monitor

    Ninja Forms < 3.4.34 - Administrator Open Redirect

    MediumCVSS 6.1Proof of conceptEPSS 2%

    ninjaforms · ninja formsApr 5, 2021