WordPress ninja-forms has 47 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2016-1209 | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized | critical | 9.8 | <=2.9.42 | – |
| CVE-2018-19287 | XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submiss | medium | 6.1 | <3.3.18 | 3.3.18 |
| CVE-2015-2220 | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to injec | medium | 4.3 | <=2.8.8 | – |
| CVE-2014-9688 | Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admi | high | 7.5 | <=2.8.9 | – |
| CVE-2018-16308 | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. | high | 8.6 | <3.3.14.1 | 3.3.14.1 |
| CVE-2019-15025 | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. | critical | 9.8 | <3.3.21.2 | 3.3.21.2 |
| CVE-2018-20981 | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data req | critical | 9.1 | <3.3.9 | 3.3.9 |
| CVE-2021-24165 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due | medium | 6.1 | <3.4.34 | 3.4.34 |
| CVE-2018-19796 | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessi | medium | 6.1 | <3.3.19.1 | 3.3.19.1 |
| CVE-2022-2903 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object inj | high | 7.2 | <3.6.13 | 3.6.13 |
| CVE-2021-24163 | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protect | high | 8.8 | <3.4.34 | 3.4.34 |
| CVE-2018-20980 | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. | high | 7.5 | <3.2.15 | 3.2.15 |
| CVE-2021-24889 | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privile | high | 7.2 | <3.6.4 | 3.6.4 |
| CVE-2020-36175 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. | medium | 5.3 | <3.4.27.1 | 3.4.27.1 |
| CVE-2020-8594 | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptc | medium | 5.4 | =3.4.22 | – |
| CVE-2021-34647 | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/i | medium | 6.5 | <=3.5.7 | – |
| CVE-2020-36173 | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. | medium | 5.3 | <3.4.28 | 3.4.28 |
| CVE-2023-1835 | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, | medium | 6.1 | <3.6.22 | 3.6.22 |
| CVE-2017-18574 | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. | medium | 6.1 | <3.0.31 | 3.0.31 |
| CVE-2021-24164 | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ | medium | 4.3 | <3.4.34.1 | 3.4.34.1 |
| CVE-2024-0685 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection | medium | 5.9 | <=3.7.1 | – |
| CVE-2023-35909 | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress le | medium | 5.3 | <3.6.26 | 3.6.26 |
| CVE-2018-7280 | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. | medium | 6.1 | <3.2.14 | 3.2.14 |
| CVE-2024-7354 | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cro | medium | 6.1 | >=3.8.6 and <3.8.11 | 3.8.11 |
| CVE-2021-34648 | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Rout | medium | 6.4 | <=3.5.7 | – |
| CVE-2023-5530 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege | medium | 4.8 | <3.6.34 | 3.6.34 |
| CVE-2020-36174 | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. | medium | 6.5 | <3.4.27.1 | 3.4.27.1 |
| CVE-2021-25056 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perf | medium | 4.8 | <3.6.10 | 3.6.10 |
| CVE-2021-25066 | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users t | medium | 4.8 | <3.6.10 | 3.6.10 |
| CVE-2025-9083 | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform P | critical | 9.8 | <3.11.1 | 3.11.1 |
| CVE-2021-36827 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via | medium | 4.8 | <=3.6.9 | – |
| CVE-2024-12238 | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in al | medium | 6.3 | <3.8.23 | 3.8.23 |
| CVE-2020-12462 | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. | medium | 6.1 | <3.4.24.2 | 3.4.24.2 |
| CVE-2021-24166 | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4 | medium | 5.4 | <3.4.34 | 3.4.34 |
| CVE-2025-11924 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in ver | high | 7.5 | <3.13.1 | 3.13.1 |
| CVE-2025-14072 | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can | medium | 5.3 | <3.13.3 | 3.13.3 |
| CVE-2024-2108 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scriptin | medium | 4.6 | <3.8.1 | 3.8.1 |
| CVE-2024-11052 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the cal | high | 7.2 | <3.8.20 | 3.8.20 |
| CVE-2025-2524 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | <3.10.1 | 3.10.1 |
| CVE-2024-13470 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plu | medium | 6.4 | <3.8.25 | 3.8.25 |
| CVE-2024-3866 | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all | medium | 4.7 | <3.8.16 | 3.8.16 |
| CVE-2025-2560 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | <3.10.1 | 3.10.1 |
| CVE-2025-2561 | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users su | medium | 4.8 | <3.10.1 | 3.10.1 |
| CVE-2025-5398 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use | medium | 6.4 | <3.10.2.2 | 3.10.2.2 |
| CVE-2024-2113 | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery | medium | 4.3 | <3.8.1 | 3.8.1 |
| CVE-2025-10498 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions | medium | 4.3 | <3.12.1 | 3.12.1 |
| CVE-2025-10499 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi | medium | 4.3 | <3.12.1 | 3.12.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked