Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how ninja forms compares to other vendors in security performance

View Risk Score →

Ninja Forms WordPress pluginNinja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default

Risk 32
Severity
4.8
First published (updated )
CVE-2026-15256

Ninja Forms Ninja Forms – The Contact Form Builder That Grows With You (WordPress plugin)Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

Risk 30
Severity
4.9
First published (updated )
CVE-2026-15663

Ninja Forms Ninja Forms WordPress pluginNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

Risk 47
Severity
8.7
First published (updated )
CVE-2026-65052

Ninja Forms WordPress pluginNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Risk 41
Severity
6.9
First published (updated )
CVE-2026-65051

Ninja Forms WordPress pluginNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors

Risk 40
Severity
7.1
First published (updated )
CVE-2026-65050
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Ninja Forms Ninja FormsNinja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action

Risk 66
Severity
8.4
First published (updated )
CVE-2026-65049

Ninja Forms Ninja Forms - Excel ExportNinja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter

Risk 39
Severity
6.4
First published (updated )
CVE-2026-15161

Ninja Forms Excel Export (WordPress plugin)Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter

Risk 22
Severity
4.3
First published (updated )
CVE-2026-15159

Ninja Forms Ninja Forms - File UploadsNinja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter

Risk 43
Severity
7.5
First published (updated )
CVE-2026-13369

Ninja Forms Ninja Forms WordPress pluginNinja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

Risk 43
Severity
7.5
First published (updated )
CVE-2026-1239
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

BleepingComputerHackers exploit critical flaw in Ninja Forms WordPress plugin

Exploited
First published (updated )
News
BleepingComputer

Ninja Forms GSheetConnectorGSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure

Risk 22
Severity
4.3
First published (updated )
CVE-2025-13136

Ninja Forms Ninja FormsNinja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

Risk 34
Severity
5.4
First published (updated )
CVE-2025-10498

Ninja Forms Ninja FormsNinja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

Risk 22
Severity
4.3
First published (updated )
CVE-2025-10499

Ninja Forms Ninja FormsNinja-forms < 3.11.1 - Unauthenticated PHP Objection

Risk 61
Severity
9.8
EPSS
0.23%
First published (updated )
CVE-2025-9083
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Ninja Forms Ninja FormsNinja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

Risk 28
Severity
6.4
EPSS
0.03%
First published (updated )
CVE-2025-5398

Ninja Forms Ninja FormsNinja Forms < 3.10.1 - Admin+ Stored XSS

Risk 29
Severity
4.8
First published (updated )
CVE-2025-2560

Ninja Forms Ninja FormsNinja Forms < 3.10.1 - Admin+ Stored XSS

Risk 29
Severity
4.8
First published (updated )
CVE-2025-2561

Ninja Forms Ninja FormsNinja Forms < 3.10.1 - Admin+ Stored XSS

Risk 29
Severity
4.8
First published (updated )
CVE-2025-2524

Ninja Forms WebhooksNinja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook

Risk 33
Severity
5.5
First published (updated )
CVE-2024-13940
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Ninja Forms Ninja FormsNinja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Risk 39
Severity
6.4
First published (updated )
CVE-2024-13470

NinjaForms Ninja Forms WordpressNinja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

Risk 46
Severity
6.3
First published (updated )
CVE-2024-12238

Ninja Forms Ninja FormsNinja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations

Risk 44
Severity
7.2
First published (updated )
CVE-2024-11052

Ninja Forms Styler for Ninja FormsStyler for Ninja Forms <= 3.3.4 - Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license

Risk 38
Severity
6.5
First published (updated )
CVE-2024-10717

Ninja Forms Ninja FormsCSRF

Risk 77
Severity
8.8
First published (updated )
CVE-2024-25572
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Ninja Forms Ninja FormsXSS

Risk 34
Severity
5.4
First published (updated )
CVE-2024-26019

Ninja Forms Ninja FormsXSS

Risk 38
Severity
6.1
First published (updated )
CVE-2024-29220

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPressNinja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting

Risk 34
Severity
5.4
First published (updated )
CVE-2024-2108

NinjaForms Ninja Forms WordpressNinja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

Risk 22
Severity
4.3
First published (updated )
CVE-2024-2113

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203