Known Vulnerabilities for Ninja Forms by Ninjaforms
Listed below are 10 of the newest known vulnerabilities associated with "Ninja Forms" by "Ninjaforms".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-102385 json | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | Not Provided | 2026-09-30 | 2026-09-30 |
| CVE-2026-95515 json | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | Not Provided | 2026-09-23 | 2026-09-23 |
| CVE-2026-94504 json | Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submiss... | Not Provided | 2026-09-22 | 2026-09-22 |
| CVE-2026-92820 json | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and inc... | Not Provided | 2026-10-02 | 2026-10-02 |
| CVE-2026-92438 json | The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission ... | Not Provided | 2026-09-22 | 2026-09-22 |
| CVE-2026-91827 json | The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an adm... | Not Provided | 2026-09-22 | 2026-09-22 |
| CVE-2026-90438 json | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scri... | Not Provided | 2026-10-02 | 2026-10-02 |
| CVE-2026-87870 json | The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters... | Not Provided | 2026-09-10 | 2026-09-11 |
| CVE-2026-81773 json | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | Not Provided | 2026-09-03 | 2026-09-05 |
| CVE-2026-81772 json | Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions. | Not Provided | 2026-09-02 | 2026-09-03 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ninjaforms | Ninja Forms | 3.4.9 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.8 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.7 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.6 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.5 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.4 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.3 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.28 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.27.1 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.27 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.26 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.25 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.24.3 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.24.2 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.22 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.2 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.10 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.1 | |||
| Application | Ninjaforms | Ninja Forms | 3.4.0 | |||
| Application | Ninjaforms | Ninja Forms | 3.3.9 |