Security
فارسی
All products

ninja-forms

WordPress · Plugin
94 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated CSV InjectionCVE-2026-67187 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL ParameterCVE-2026-100151 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge TagCVE-2026-100155 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key NormalizationCVE-2026-109997 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_nameCVE-2026-101326 ninja-forms WordPress Medium Fix reported
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-110899 ninja-forms WordPress High Fix reported
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-102385 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field SubmissionCVE-2026-90438 ninja-forms WordPress High Fix reported
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-95515 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-92438 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object InjectionCVE-2026-91827 ninja-forms WordPress High Fix reported
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site ScriptingCVE-2026-94504 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2026-15256 ninja-forms WordPress Medium Fix reported
Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information ExposureCVE-2026-80438 ninja-forms WordPress Low Fix reported
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode ExecutionCVE-2026-80437 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form ImportCVE-2026-11363 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array KeyCVE-2026-19769 ninja-forms WordPress High Fix reported
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' KeyCVE-2026-15663 ninja-forms WordPress Medium Fix reported
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST EndpointCVE-2026-1239 ninja-forms WordPress High Fix reported
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection InjectionCVE-2022-2903 ninja-forms WordPress High Fix reported