Log in Start free

Saturday Drive

Products

ProductCVEsExploitedLatest
Ninja Forms16–Oct 28, 2026
Ninja Forms Contact Form2–Apr 17, 2024
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress1–Dec 7, 2023
Ninja Forms Contact Form (WordPress plugin)1–Jun 16, 2022
Ninja Forms File Uploads Extension1–Sep 3, 2026
Ninja Forms - Layout & Styles1–Sep 2, 2026
Ninja Forms - Save Progress1–Sep 5, 2026
Ninja Forms - Scheduled Exports1–Sep 10, 2026

Exploited and recent CVEs

  • CVE-2026-67187 High 7.1 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields 0.2%
  • CVE-2026-87870 Medium 6.4 Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters 0.3%
  • CVE-2026-15550 Medium 4.3 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook 0.3%
  • CVE-2026-81773 High 7.1 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-81772 High 8.8 WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability 0.5%
  • CVE-2026-65052 High 7.5 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields 0.6%
  • CVE-2026-65051 Medium 6.5 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler 0.5%
  • CVE-2026-65050 Medium 6.5 Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors 0.4%
  • CVE-2026-65049 Critical 9.3 Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action 0.4%
  • CVE-2026-65048 Critical 9.3 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index 0.5%
  • CVE-2024-43999 Medium 5.9 WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2024-39628 Medium 5.4 WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-37934 Medium 5.4 WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability 0.5%
  • CVE-2023-38393 High 7.6 WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability 0.5%
  • CVE-2023-38386 High 7.6 WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability 0.5%
  • CVE-2023-36505 Medium 6.8 WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion 0.6%
  • CVE-2024-25572 High 8.8 Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. 0.3%
  • CVE-2024-26019 Medium 5.4 Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user wh 0.5%
  • CVE-2024-29220 Medium 6.1 Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the 0.5%
  • CVE-2023-35909 Medium 5.3 WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack 0.8%
  • CVE-2023-37979 High 7.1 WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS) 9.7%
  • CVE-2021-36827 Medium 4.8 WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability 0.5%
  • CVE-2021-34647 Medium 6.5 Ninja Forms <= 3.5.7 Sensitive Information Disclosure 1.2%
  • CVE-2021-34648 Medium 6.4 Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection 0.7%