Plugin icon

File Uploads

ninja-forms-uploads

Vulnerabilities:

10

Last Updated:

September 28, 2026

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-10-01
Title
Ninja Forms - File Uploads < 3.3.35 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 3.3.35
CVSS
8.1 (high)
Published
2026-09-02
Title
Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
Fixed in
No known fix
CVSS
7.2 (high)
Published
2026-07-02
Title
Ninja Forms - File Uploads < 3.3.30 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
Fixed in
Fixed in 3.3.30
CVSS
5.3 (medium)
Published
2026-07-01
Title
Ninja Forms - File Uploads < 3.3.30 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
Fixed in
Fixed in 3.3.30
CVSS
7.5 (high)
Published
2026-04-08
Title
Ninja Forms File Uploads Extension <= 3.3.26 - Cross-Site Request Forgery
Fixed in
No known fix
CVSS
4.3 (medium)
Published
2026-04-06
Title
Ninja Forms - File Upload < 3.3.27 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 3.3.27
CVSS
9.8 (critical)
Published
2024-09-06
Title
Ninja Forms File Uploads < 3.3.18 - Unauthenticated Stored Cross-Site Scripting via File Upload
Fixed in
Fixed in 3.3.18
CVSS
7.2 (high)
Published
2022-03-08
Title
Ninja Forms File Uploads Extension < 3.3.13 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.13
CVSS
7.2 (high)
Published
2022-03-08
Title
Ninja Forms File Uploads Extension < 3.3.1 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 3.3.1
CVSS
9.8 (critical)
Published
2019-04-11
Title
Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 3.0.23
CVSS
8.1 (high)