Advisories · Technology

Saturday Drive Ninja Forms.

Every CVE that names Saturday Drive Ninja Forms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-67187 CVE record

CVSS 5.1 Medium

Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields
- Saturday Drive Ninja Forms
- Other injection
Not analysed yet 28 Oct 2026
CVE-2026-65052 CVE record

CVSS 8.7 High

Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields
- Saturday Drive Ninja Forms
- CWE-472
Not analysed yet 21 Jul 2026
CVE-2026-65051 CVE record

CVSS 6.9 Medium

Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler
- Saturday Drive Ninja Forms
- CWE-602
Not analysed yet 21 Jul 2026
CVE-2026-65050 CVE record

CVSS 7.1 High

Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-65049 CVE record

CVSS 8.4 High

Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-65048 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index
- Saturday Drive Ninja Forms
- Cross-site scripting (XSS)
Not analysed yet 21 Jul 2026
CVE-2024-43999 CVE record

CVSS 5.9 Medium

WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability
- Saturday Drive Ninja Forms
- Cross-site scripting (XSS)
Not analysed yet 17 Sept 2024
CVE-2024-39628 CVE record

CVSS 5.4 Medium

WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability
- Saturday Drive Ninja Forms
- Cross-site request forgery (CSRF)
Not analysed yet 26 Aug 2024
CVE-2024-37934 CVE record

CVSS 5.4 Medium

WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability
- Saturday Drive Ninja Forms
- Code injection
Not analysed yet 9 Jul 2024
CVE-2023-38393 CVE record

CVSS 7.6 High

WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 19 Jun 2024
CVE-2023-38386 CVE record

CVSS 7.6 High

WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 19 Jun 2024
CVE-2024-25572 CVE record

CVSS 8.8 High

Cross-site request forgery in Saturday Drive Ninja Forms
- Saturday Drive Ninja Forms
- Cross-site request forgery (CSRF)
Not analysed yet 11 Apr 2024
CVE-2024-26019 CVE record

CVSS 5.4 Medium

Cross-site scripting in Saturday Drive Ninja Forms
- Saturday Drive Ninja Forms
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2024
CVE-2024-29220 CVE record

CVSS 6.1 Medium

Cross-site scripting in Saturday Drive Ninja Forms
- Saturday Drive Ninja Forms
- Cross-site scripting (XSS)
Not analysed yet 11 Apr 2024
CVE-2021-34647 CVE record

CVSS 6.5 Medium

Ninja Forms <= 3.5.7 Sensitive Information Disclosure
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 22 Sept 2021
CVE-2021-34648 CVE record

CVSS 6.4 Medium

Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection
- Saturday Drive Ninja Forms
- Broken access control
Not analysed yet 22 Sept 2021