kstover Ninja Forms – The Contact Form Builder That Grows With You

• CVE-2026-11363 Medium 6.6 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import 0.9%
• CVE-2026-19769 High 7.2 Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key 0.4%
• CVE-2026-15663 Medium 4.9 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key 0.5%
• CVE-2026-1239 High 7.5 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint 0.5%
• CVE-2026-1307 Medium 6.5 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token 0.2%
• CVE-2026-2268 High 7.5 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action 0.4%
• CVE-2025-11924 High 7.5 Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token 0.4%
• CVE-2025-10498 Medium 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion 0.2%
• CVE-2025-10499 Medium 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update 0.2%
• CVE-2025-5398 Medium 6.4 Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI 0.2%
• CVE-2024-13470 Medium 6.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2024-12238 Medium 6.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution 0.5%
• CVE-2024-11052 High 7.2 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations 0.3%
• CVE-2024-3866 Medium 4.7 Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer 0.3%
• CVE-2024-2108 Medium 4.6 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting 0.3%
• CVE-2024-2113 Medium 4.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export 0.2%
• CVE-2024-0685 Medium 5.9 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection 0.8%