| CVE-2026-91827 |
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when…
|
7.5
High
|
Sep 22, 2026 |
| CVE-2026-92438 |
The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the…
|
8.8
High
|
Sep 22, 2026 |
| CVE-2026-80437 |
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from…
|
4.8
Medium
|
Sep 6, 2026 |
| CVE-2026-80438 |
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a…
|
5.9
Medium
|
Sep 4, 2026 |
| CVE-2026-15256 |
The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to…
|
4.8
Medium
|
Aug 6, 2026 |
| CVE-2025-14072 |
The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the…
|
5.3
Medium
|
Jan 2, 2026 |
| CVE-2025-9083 |
The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow…
|
9.8
Critical
|
Sep 18, 2025 |
| CVE-2025-2561 |
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow…
|
4.8
Medium
|
May 19, 2025 |
| CVE-2025-2560 |
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow…
|
4.8
Medium
|
May 19, 2025 |
| CVE-2025-2524 |
The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow…
|
4.8
Medium
|
May 19, 2025 |
| CVE-2024-7354 |
The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute,…
|
6.1
Medium
|
Sep 2, 2024 |