Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

Уязвимости

• CVE-2024-0685без авторизации≤ 3.7.1

  Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection

  Критич. 9.8

• CVE-2019-15025без авторизации

  The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.

  Критич. 9.8

• CVE-2016-1209без авторизации

  The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized

  Критич. 9.8

• CVE-2024-37934подписчик+≤ 3.8.4

  WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

  Критич. 9.8

• CVE-2023-38386участник+≤ 3.6.25

  WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability

  Критич. 9.8

• CVE-2026-65048без авторизации · нужен клик→ 3.14.9

  Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

  Критич. 9.3

• CVE-2018-20981без авторизации

  The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req

  Критич. 9.1

• CVE-2024-39628без авторизации · нужен клик≤ 3.8.6

  WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability

  Высокий 8.8

• CVE-2024-25572без авторизации · нужен клик

  Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.

  Высокий 8.8

• CVE-2023-38393подписчик+≤ 3.6.25

  WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability

  Высокий 8.8

• CVE-2026-65052без авторизации→ 3.14.9

  Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

  Высокий 8.7

• CVE-2018-16308без авторизации · нужен клик

  The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.

  Высокий 8.6

• CVE-2026-65049без авторизации · нужен клик→ 3.14.9

  Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action

  Высокий 8.4

• CVE-2026-1239без авторизации≤ 3.14.1

  Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

  Высокий 7.5

• CVE-2026-2268без авторизации≤ 3.14.0

  Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

  Высокий 7.5

• CVE-2025-11924без авторизации≤ 3.13.2

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Un

  Высокий 7.5

• CVE-2018-20980без авторизации

  The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.

  Высокий 7.5

• CVE-2014-9688

  Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi

  Высокий 7.5

• CVE-2026-90438без авторизации≤ 3.15.4

  Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

  Высокий 7.2

• CVE-2026-94504без авторизации≤ 3.15.3

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

  Высокий 7.2

• CVE-2026-19769без авторизации≤ 3.15.1

  Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key

  Высокий 7.2

• CVE-2023-36505высокие права≤ 3.6.24

  WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion

  Высокий 7.2

• CVE-2026-102385без авторизации · нужен клик≤ 3.15.3

  WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-95515без авторизации · нужен клик≤ 3.15.3

  WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

  Высокий 7.1

• CVE-2026-65050без авторизации→ 3.14.9

  Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors

  Высокий 7.1

• CVE-2026-65051без авторизации→ 3.14.9

  Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

  Средний 6.9

• CVE-2026-11363админ≤ 3.14.6

  Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

  Средний 6.6

• CVE-2020-36174без авторизации · нужен клик

  The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.

  Средний 6.5

• CVE-2021-34647нужен вход≤ 3.5.7

  Ninja Forms <= 3.5.7 Sensitive Information Disclosure

  Средний 6.5

• CVE-2026-1307участник+≤ 3.14.1

  Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token

  Средний 6.5

• CVE-2024-12238подписчик+≤ 3.8.22

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

  Средний 6.3

• CVE-2024-11052без авторизации≤ 3.8.19

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations

  Средний 6.1

• CVE-2024-3866без авторизации · нужен клик≤ 3.8.15

  Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer

  Средний 6.1

• CVE-2024-29220без авторизации · нужен клик

  Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels.

  Средний 6.1

• CVE-2023-37979без авторизации · нужен клик≤ 3.6.25

  WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)

  Средний 6.1

• CVE-2020-12462без авторизации · нужен клик

  The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.

  Средний 6.1

• CVE-2017-18574без авторизации · нужен клик

  The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.

  Средний 6.1

• CVE-2018-19796без авторизации · нужен клик

  An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi

  Средний 6.1

• CVE-2018-19287без авторизации · нужен клик

  XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss

  Средний 6.1

• CVE-2018-7280без авторизации · нужен клик

  The Ninja Forms plugin before 3.2.14 for WordPress has XSS.

  Средний 6.1

• CVE-2025-10498без авторизации · нужен клик≤ 3.12.0

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

  Средний 5.4

• CVE-2024-26019нужен вход

  Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing.

  Средний 5.4

• CVE-2020-8594нужен вход

  The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc

  Средний 5.4

• CVE-2025-5398участник+≤ 3.10.2.1

  Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

  Средний 5.4

• CVE-2024-13470участник+≤ 3.8.24

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Средний 5.4

• CVE-2024-2108автор+≤ 3.8.0

  Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting

  Средний 5.4

• CVE-2023-35909без авторизации≤ 3.6.25

  WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack

  Средний 5.3

• CVE-2020-36175без авторизации

  The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.

  Средний 5.3

• CVE-2020-36173без авторизации

  The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.

  Средний 5.3

• CVE-2026-15663админ≤ 3.14.9

  Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

  Средний 4.9

• CVE-2024-50515высокие права≤ 3.8.16

  WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2024-50514высокие права≤ 3.8.16

  WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2024-43999высокие права≤ 3.8.11

  WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2021-36827админ≤ 3.6.9

  WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

  Средний 4.8

• CVE-2025-10499без авторизации · нужен клик≤ 3.12.0

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

  Средний 4.3

• CVE-2024-2113без авторизации · нужен клик≤ 3.8.0

  Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

  Средний 4.3

• CVE-2021-34648нужен вход≤ 3.5.7

  Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection

  Средний 4.3

• CVE-2015-2220

  Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec

  Средний 4.3