Unknown Ninja Forms

• CVE-2026-91827 High 7.5 Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export 0.3%
• CVE-2026-92438 High 8.8 Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin 0.4%
• CVE-2026-80437 Medium 4.8 Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags 0.2%
• CVE-2026-80438 Medium 5.9 Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API 0.2%
• CVE-2026-15256 Medium 4.8 Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default 0.2%
• CVE-2025-14072 Medium 5.3 Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure 0.3%
• CVE-2025-9083 Critical 9.8 Ninja-forms < 3.11.1 - Unauthenticated PHP Objection 0.5%
• CVE-2025-2561 Medium 4.8 Ninja Forms < 3.10.1 - Admin+ Stored XSS 0.3%
• CVE-2025-2560 Medium 4.8 Ninja Forms < 3.10.1 - Admin+ Stored XSS 0.3%
• CVE-2025-2524 Medium 4.8 Ninja Forms < 3.10.1 - Admin+ Stored XSS 0.3%
• CVE-2024-7354 Medium 6.1 Ninja Forms 3.8.6-3.8.10 - Reflected XSS 0.7%