Ninja Forms
ninja-forms · eklenti
Ninja Forms için bilinen güvenlik açıkları. Sitenizde bu bileşenin hangi sürümünün çalıştığını WP Lens ile saniyede öğrenin.
57 bilinen açık
7 kritik · 3 kayıt için istismar kodu yayımlanmış · son kayıt 30 Eyl 2026
Güvenlik açıkları
- Kritik 9.8
WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability
- Kritik 9.8
WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability
- Kritik 9.8
Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection
- Kritik 9.8
The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.
- Kritik 9.8
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized
- Kritik 9.3
CVE-2026-65048→ 3.14.9
Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
- Kritik 9.1
The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req
- Yüksek 8.8
WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability
- Yüksek 8.8
WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability
- Yüksek 8.8
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.
- Yüksek 8.7
CVE-2026-65052→ 3.14.9
Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
- Yüksek 8.6
The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.
- Yüksek 8.4
CVE-2026-65049→ 3.14.9
Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
- Yüksek 7.5
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
- Yüksek 7.5
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
- Yüksek 7.5
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Un
- Yüksek 7.5
The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.
- Yüksek 7.5
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi
- Yüksek 7.2
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
- Yüksek 7.2
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
- Yüksek 7.2
WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion
- Yüksek 7.1
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- Yüksek 7.1
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- Yüksek 7.1
CVE-2026-65050→ 3.14.9
Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors
- Orta 6.9
CVE-2026-65051→ 3.14.9
Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
- Orta 6.6
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
- Orta 6.5
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
- Orta 6.5
Ninja Forms <= 3.5.7 Sensitive Information Disclosure
- Orta 6.5
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
- Orta 6.3
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- Orta 6.1
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations
- Orta 6.1
Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer
- Orta 6.1
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels.
- Orta 6.1
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)
- Orta 6.1
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
- Orta 6.1
The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.
- Orta 6.1
An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi
- Orta 6.1
XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss
- Orta 6.1
The Ninja Forms plugin before 3.2.14 for WordPress has XSS.
- Orta 5.4
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
- Orta 5.4
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
- Orta 5.4
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- Orta 5.4
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing.
- Orta 5.4
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
- Orta 5.4
The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc
- Orta 5.3
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack
- Orta 5.3
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
- Orta 5.3
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
- Orta 4.9
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
- Orta 4.8
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
- Orta 4.8
WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability
- Orta 4.8
WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability
- Orta 4.8
WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
- Orta 4.3
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
- Orta 4.3
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export
- Orta 4.3
Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection
- Orta 4.3
Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec