WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
ninja-forms
Published
2026-09-02
Title
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
Slug
ninja-forms
Published
2026-09-04
Title
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
Slug
ninja-forms
Published
2026-09-04
Title
Ninja Forms < 3.15.2 - Unauthenticated Stored XSS via Repeater Child Type Confusion
Slug
ninja-forms
Published
2026-09-08
Title
Ninja Forms < 3.14.7 - Admin+ PHP Object Injection via Form Import
Slug
ninja-forms
Published
2026-09-30
Title
Ninja Forms < 3.15.5 - Unauthenticated Stored XSS
Slug
ninja-forms
Published
2026-10-19
Title
Ninja Forms < 3.15.6 - Unauthenticated Stored XSS
Slug
ninja-forms
Published
2026-10-30
Title
Ninja Forms < 3.15.6 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Values in Success Message
Slug
ninja-forms
Published
2026-10-30
Title
Ninja Forms < 3.15.6 - Unauthenticated Stored XSS via 'extra' Parameter
Slug
ninja-forms
Published
2026-09-22
Title
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
Slug
ninja-forms
Published
2026-09-22
Title
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
Slug
ninja-forms
Published
2026-10-30
Title
Ninja Forms < 3.15.6 - Subscriber+ Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag
Slug
ninja-forms
Published
2026-10-30
Title
Ninja Forms < 3.15.6 - Reflected DOM-Based XSS via 'querystring:<key>' URL Parameter
Slug
ninja-forms-excel-export
Published
2026-07-16
Title
Ninja Forms - Excel Export < 3.3.7 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
Slug
ninja-forms-excel-export
Published
2026-07-16
Title
Ninja Forms - Excel Export < 3.3.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
Slug
ninja-forms-excel-export
Published
2026-07-16
Title
Ninja Forms - Excel Export < 3.3.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter
Slug
ninja-forms-save-progress
Published
2026-09-04
Title
Ninja Forms - Save Progress < 3.0.31 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Slug
ninja-forms-scheduled-exports
Published
2026-09-04
Title
Ninja Forms - Scheduled Exports < 3.0.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
Slug
ninja-forms-style
Published
2026-09-01
Title
Ninja Forms - Layout & Styles < 3.0.32 - Unauthenticated PHP Object Injection
Slug
ninja-forms-uploads
Published
2019-04-11
Title
Ninja Forms File Uploads Extension <= 3.0.22 - Unauthenticated Arbitrary File Upload
Slug
ninja-forms-uploads
Published
2022-03-08
Title
Ninja Forms File Uploads Extension < 3.3.13 - Unauthenticated Stored Cross-Site Scripting
Slug
ninja-forms-uploads
Published
2022-03-08
Title
Ninja Forms File Uploads Extension < 3.3.1 - Unauthenticated Arbitrary File Upload
Slug
ninja-forms-uploads
Published
2024-09-06
Title
Ninja Forms File Uploads < 3.3.18 - Unauthenticated Stored Cross-Site Scripting via File Upload
Slug
ninja-forms-uploads
Published
2026-04-06
Title
Ninja Forms - File Upload < 3.3.27 - Unauthenticated Arbitrary File Upload
Slug
ninja-forms-uploads
Published
2026-07-02
Title
Ninja Forms - File Uploads < 3.3.30 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
Slug
ninja-forms-uploads
Published
2026-07-01
Title
Ninja Forms - File Uploads < 3.3.30 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter