Ninja Forms (Unknown) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-22. Vendor: Unknown.
CVEs of Ninja Forms
- CVE-2026-91827 - CVSS 7.5 (high), 2026-09-22: The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form…
- CVE-2026-92438 - CVSS 8.8 (high), 2026-09-22: The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area,…
- CVE-2026-80437 - CVSS 4.8 (medium), 2026-09-06: The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them…
- CVE-2026-80438 - CVSS 5.9 (medium), 2026-09-04: The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before…
- CVE-2026-15256 - CVSS 4.8 (medium), 2026-08-06: The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from…
- CVE-2025-14072 - CVSS 5.3 (medium), 2026-01-02: The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to…
- CVE-2025-9083 - CVSS 9.8 (critical), 2025-09-18: The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection…
- CVE-2025-2560 - CVSS 4.8 (medium), 2025-05-19: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2025-2524 - CVSS 4.8 (medium), 2025-05-19: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2025-2561 - CVSS 4.8 (medium), 2025-05-19: The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
- CVE-2024-7354 - CVSS 6.1 (medium), 2024-09-02: The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting…
