Ninja Forms
ninja-forms · plugin
Known security vulnerabilities for Ninja Forms. Find out in seconds which version runs on your site with WP Lens.
57 known vulnerabilities
7 critical · 3 with public exploit code · latest Sep 30, 2026
Vulnerabilities
- Critical 9.8
WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability
- Critical 9.8
WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability
- Critical 9.8
Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection
- Critical 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
- Critical 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized
- Critical 9.3
CVE-2026-65048→ 3.14.9
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
- Critical 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req
- High 8.8
WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability
- High 8.8
WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability
- High 8.8
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.
- High 8.7
CVE-2026-65052→ 3.14.9
Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
- High 8.6
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
- High 8.4
CVE-2026-65049→ 3.14.9
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
- High 7.5
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
- High 7.5
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
- High 7.5
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Un
- High 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
- High 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi
- High 7.2
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
- High 7.2
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
- High 7.2
WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion
- High 7.1
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- High 7.1
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- High 7.1
CVE-2026-65050→ 3.14.9
Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors
- Medium 6.9
CVE-2026-65051→ 3.14.9
Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
- Medium 6.6
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
- Medium 6.5
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
- Medium 6.5
Ninja Forms <= 3.5.7 Sensitive Information Disclosure
- Medium 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
- Medium 6.3
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- Medium 6.1
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations
- Medium 6.1
Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer
- Medium 6.1
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels.
- Medium 6.1
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
- Medium 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
- Medium 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- Medium 6.1
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi
- Medium 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss
- Medium 6.1
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- Medium 5.4
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
- Medium 5.4
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
- Medium 5.4
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Medium 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing.
- Medium 5.4
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Medium 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc
- Medium 5.3
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack
- Medium 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- Medium 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
- Medium 4.9
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
- Medium 4.8
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
- Medium 4.8
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
- Medium 4.8
WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability
- Medium 4.8
WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
- Medium 4.3
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
- Medium 4.3
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export
- Medium 4.3
Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection
- Medium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec