Copy
CVE-2024-29220
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Source: JPCERT/CC
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-04-11
Updated
2024-04-11
CVE-2024-26019
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
Source: JPCERT/CC
Max CVSS
N/A
EPSS Score
0.05%
Published
2024-04-11
Updated
2024-04-11
CVE-2024-2108
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Source: Wordfence
Max CVSS
4.6
EPSS Score
0.04%
Published
2024-03-29
Updated
2024-03-29
CVE-2024-0685
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export.
Source: Wordfence
Max CVSS
9.8
EPSS Score
0.07%
Published
2024-02-02
Updated
2024-02-12
CVE-2023-38393
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Source: Patchstack
Max CVSS
8.8
EPSS Score
0.05%
Published
2024-06-19
Updated
2024-07-31
CVE-2023-38386
Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.
Source: Patchstack
Max CVSS
7.6
EPSS Score
0.04%
Published
2024-06-19
Updated
2024-06-20
CVE-2023-37979
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <=3.6.25 versions.
Source: Patchstack
Max CVSS
7.1
EPSS Score
0.11%
Published
2023-07-27
Updated
2023-08-04
CVE-2023-35909
Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25.
Source: Patchstack
Max CVSS
5.3
EPSS Score
0.05%
Published
2023-12-07
Updated
2023-12-12
CVE-2023-5530
The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue
Source: WPScan
Max CVSS
4.8
EPSS Score
0.05%
Published
2023-11-06
Updated
2023-11-14
CVE-2023-1835
The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Source: WPScan
Max CVSS
6.1
EPSS Score
0.14%
Published
2023-05-15
Updated
2023-05-23
CVE-2022-2903
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Source: WPScan
Max CVSS
7.2
EPSS Score
0.10%
Published
2022-09-26
Updated
2022-09-28
CVE-2021-36827
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label".
Source: Patchstack
Max CVSS
4.8
EPSS Score
0.05%
Published
2022-06-16
Updated
2023-04-04
CVE-2021-34648
The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims.
Source: Wordfence
Max CVSS
6.4
EPSS Score
0.05%
Published
2021-09-22
Updated
2022-10-27
CVE-2021-34647
The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
Source: Wordfence
Max CVSS
6.5
EPSS Score
0.07%
Published
2021-09-22
Updated
2022-10-27
CVE-2021-25066
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Source: WPScan
Max CVSS
4.8
EPSS Score
0.06%
Published
2022-07-04
Updated
2022-07-12
CVE-2021-25056
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Source: WPScan
Max CVSS
4.8
EPSS Score
0.06%
Published
2022-07-04
Updated
2022-07-13
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks
Source: WPScan
Max CVSS
7.2
EPSS Score
0.09%
Published
2021-11-29
Updated
2021-11-29
CVE-2021-24166
The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection.
Source: WPScan
Max CVSS
5.8
EPSS Score
0.09%
Published
2021-04-05
Updated
2021-04-09
CVE-2021-24165
In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place.
Source: WPScan
Max CVSS
6.1
EPSS Score
0.13%
Published
2021-04-05
Updated
2021-04-09
CVE-2021-24164
In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection.
Source: WPScan
Max CVSS
4.3
EPSS Score
0.05%
Published
2021-04-05
Updated
2022-08-30
CVE-2021-24163
The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin.
Source: WPScan
Max CVSS
8.8
EPSS Score
0.10%
Published
2021-04-05
Updated
2022-08-30
CVE-2020-36175
The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.08%
Published
2021-01-06
Updated
2021-07-21
CVE-2020-36174
The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.
Source: MITRE
Max CVSS
6.5
EPSS Score
0.05%
Published
2021-01-06
Updated
2021-01-08
CVE-2020-36173
The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.
Source: MITRE
Max CVSS
5.3
EPSS Score
0.08%
Published
2021-01-06
Updated
2021-07-21
CVE-2020-12462
The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.
Source: MITRE
Max CVSS
6.1
EPSS Score
0.05%
Published
2020-04-29
Updated
2020-05-06
35 vulnerabilities found
12