Advisories · Technology
Ninja Forms.
Every CVE that names Ninja Forms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
- Ninja Forms
- Insecure deserialization
- CVSS 8.8 High
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
- Ninja Forms
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags
- Ninja Forms
- Other injection
- CVSS 5.9 Medium
Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API
- Ninja Forms
- Broken access control
- CVSS 4.8 Medium
Ninja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default
- Ninja Forms
- Other injection
- CVSS 5.3 Medium
Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure
- Ninja Forms
- CVSS 9.8 CriticalCritical · CVSS 9+
Ninja-forms < 3.11.1 - Unauthenticated PHP Objection
- Ninja Forms
- CVSS 4.8 Medium
Ninja Forms < 3.10.1 - Admin+ Stored XSS
- Ninja Forms
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Ninja Forms < 3.10.1 - Admin+ Stored XSS
- Ninja Forms
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Ninja Forms < 3.10.1 - Admin+ Stored XSS
- Ninja Forms
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Ninja Forms 3.8.6-3.8.10 - Reflected XSS
- Ninja Forms