Advisories · Technology
kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder.
Every CVE that names kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Code injection
- CVSS 7.2 High
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Code injection
- CVSS 7.2 High
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)