Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-03
Ninja Forms - Security Vulnerability (CVE-2026-90438)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the targeted Paragraph Text field has the Rich Text Editor (RTE) option enabled.
PLUGIN
Ninja Forms
CVE-2026-90438
Risk Score
Threat Entry
Updated 2026-09-30
Ninja Forms - Security Vulnerability (CVE-2026-102385)
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms
PLUGIN
Ninja Forms
CVE-2026-102385
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-92438)
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through a public form that then execute in the browser of any high-privileged user who reviews the submission.
PLUGIN
Ninja Forms
CVE-2026-92438
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-91827)
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
PLUGIN
Ninja Forms
CVE-2026-91827
Risk Score
Threat Entry
Updated 2026-09-22
Ninja Forms - Security Vulnerability (CVE-2026-94504)
Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
PLUGIN
Ninja Forms
CVE-2026-94504
Risk Score
Threat Entry
Updated 2026-09-09
Ninja Forms - PHP Object Injection (CVE-2026-11363)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via…
PLUGIN
Ninja Forms
CVE-2026-11363
Risk Score
Threat Entry
Updated 2026-09-08
Ninja Forms - Security Vulnerability (CVE-2026-80437)
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
PLUGIN
Ninja Forms
CVE-2026-80437
Risk Score
Threat Entry
Updated 2026-09-08
Ninja Forms - Cross-Site Scripting (XSS) (CVE-2026-19769)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through…
PLUGIN
Ninja Forms
CVE-2026-19769
Risk Score
Threat Entry
Updated 2026-09-08
Ninja Forms - Security Vulnerability (CVE-2026-80438)
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must…
PLUGIN
Ninja Forms
CVE-2026-80438
Risk Score
Threat Entry
Updated 2026-08-26
Ninja Forms - Security Vulnerability (CVE-2026-15256)
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.
PLUGIN
Ninja Forms
CVE-2026-15256
Risk Score
Threat Entry
Updated 2026-07-24
Ninja Forms - SQL Injection (CVE-2026-15663)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from…
PLUGIN
Ninja Forms
CVE-2026-15663
Risk Score
Threat Entry
Updated 2026-07-22
Ninja Forms - Improper Input Validation (CVE-2026-65052)
Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect or ListRadio fields. Attackers can tamper with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-controlled values, enabling manipulation of payment amounts to zero or arbitrary figures and bypassing admin-configured pricing logic.
PLUGIN
Ninja Forms
CVE-2026-65052
Risk Score
Threat Entry
Updated 2026-07-23
Ninja Forms - Broken Access Control (CVE-2026-65050)
Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can retrieve the signed bearer token injected into every page visitor's browser via `wp_localize_script` and use it against the REST API submissions endpoint to access all saved form submission field values, including sensitive personally identifiable information such as names, email…
PLUGIN
Ninja Forms
CVE-2026-65050
Risk Score
Threat Entry
Updated 2026-07-23
Ninja Forms - Security Vulnerability (CVE-2026-65051)
Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs. Attackers can craft a malicious AJAX submission overriding field types, removing required flags, and disabling CAPTCHA checks through the nopriv AJAX endpoint to trigger form actions such as email notifications and database storage with unverified, attacker-controlled content.
PLUGIN
Ninja Forms
CVE-2026-65051
Risk Score
Threat Entry
Updated 2026-07-21
Ninja Forms - Cross-Site Scripting (XSS) (CVE-2026-65048)
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submission indexes without numeric validation, and admin_form_element() interpolates the index directly into HTML without escaping. An unauthenticated attacker can submit a public form with a crafted repeater child key containing malicious script payloads, which execute in an administrator's browser when viewing submissions in the WordPress admin panel, enabling session-cookie theft, creation of administrator accounts, installation of malicious plugins, and arbitrary modification of site…
PLUGIN
Ninja Forms
CVE-2026-65048
Risk Score
Threat Entry
Updated 2026-07-21
Ninja Forms - Broken Access Control (CVE-2026-65049)
Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration defaults. Attackers can send a crafted POST request to the admin-ajax.php endpoint with the nf_delete_all_data action and a per-site nonce to invoke migration routines that unconditionally iterate all blogs via switch_to_blog(), dropping all nf3_* tables and clearing options and transients across every subsite in the network without requiring super-admin or…
PLUGIN
Ninja Forms
CVE-2026-65049
Risk Score
Threat Entry
Updated 2026-07-01
Ninja Forms - Broken Access Control (CVE-2026-1239)
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up to, and including, 3.14.1. This makes it possible for unauthenticated attackers to view form submissions, which could potentially contain sensitive information.
PLUGIN
Ninja Forms
CVE-2026-1239
Risk Score
Threat Entry
Updated 2026-06-17
Ninja Forms - Information Disclosure (CVE-2026-1307)
The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to an authorization token to view form submissions for arbitrary forms, which could potentially contain sensitive information.
PLUGIN
Ninja Forms
CVE-2026-1307
Risk Score
Threat Entry
Updated 2026-06-17
Ninja Forms - Information Disclosure (CVE-2026-2268)
The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resolution of `{post_meta:KEY}` merge tags without authorization checks. This makes it possible for unauthenticated attackers to extract arbitrary post metadata from any post on the site, including sensitive data such as WooCommerce billing emails, API keys, private tokens, and customer personal information via the `nf_ajax_submit` AJAX action.
PLUGIN
Ninja Forms
CVE-2026-2268
Risk Score
Threat Entry
Updated 2026-06-17
Ninja Forms - Security Vulnerability (CVE-2025-14072)
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions.
PLUGIN
Ninja Forms
CVE-2025-14072
Risk Score