Saturday Drive Ninja Forms

• CVE-2026-67187 High 7.1 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields 0.2%
• CVE-2026-65052 High 7.5 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields 0.6%
• CVE-2026-65051 Medium 6.5 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler 0.5%
• CVE-2026-65050 Medium 6.5 Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors 0.4%
• CVE-2026-65049 Critical 9.3 Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action 0.4%
• CVE-2026-65048 Critical 9.3 Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index 0.5%
• CVE-2024-43999 Medium 5.9 WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability 0.3%
• CVE-2024-39628 Medium 5.4 WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
• CVE-2024-37934 Medium 5.4 WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability 0.5%
• CVE-2023-38393 High 7.6 WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability 0.5%
• CVE-2023-38386 High 7.6 WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability 0.5%
• CVE-2024-25572 High 8.8 Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. 0.3%
• CVE-2024-26019 Medium 5.4 Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user wh 0.5%
• CVE-2024-29220 Medium 6.1 Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the 0.5%
• CVE-2021-34647 Medium 6.5 Ninja Forms <= 3.5.7 Sensitive Information Disclosure 1.2%
• CVE-2021-34648 Medium 6.4 Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection 0.7%