CVE-2026-0740

ninja.py An experimental/tool script that uses file upload endpoints for the Ninja Forms plugin on WordPress sites. It sends requests sequentially to targets in list.txt and writes successful uploads to the shell.txt file. Requirements Python 3 requests usually installed together with urllib3 pip...

Ninja Forms File Uploads <= 3.3.26 - Arbitrary File Upload

Ninja Forms File Uploads plugin for WordPress versions up to and including 3.3.26 is vulnerable to unauthenticated arbitrary file upload which could lead to remote code execution. id: CVE-2026-0740 info: name: Ninja Forms File Uploads = 3.3.26 - Arbitrary File Upload author: whattheslime severity...

Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting

The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin id: CVE-2024-7354 info: name: Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting...

WordPress Ninja Forms <3.4.34 - Open Redirect

WordPress Ninja Forms plugin before 3.4.34 contains an open redirect vulnerability via the wpajaxnfoauthconnect AJAX action, due to the use of a user-supplied redirect parameter and no protection in place. An attacker can redirect a user to a malicious site and possibly obtain sensitive...

WordPress Ninja Forms <3.3.18 - Cross-Site Scripting

WordPress Ninja Forms plugin before 3.3.18 contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in includes/Admin/Menus/Submissions.php via the begindate, enddate, or formid parameters. This can allow an attacker to steal cookie-based authentication credentials a...

ninja-form-exploit

ninja-form-exploit CVE-2026-0740 — Multi-threaded vulnerability scanner for the Ninja Forms File Upload path traversal issue on WordPress. Description main.py scans a list of WordPress targets to determine whether the Ninja Forms File Uploads plugin is vulnerable to CVE-2026-0740. Brief flow: 1...

CVE-2026-0740

CVE-2026-0740 Ninja Forms File Uploads = 3.3.26 - Unauthenticated Arbitrary File Upload to RCE Exploit for CVE-2026-0740 discovered by Selim Lanouar whattheslime. For a complete technical deep dive, read the full article on Lexfo's blog. Disclaimer This repository is provided for research and...

CVE-2026-67187

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

EUVD-2026-112137

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-67187 Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NFAbstractsList falls through to a validat...

CVE-2026-67187

The Ninja Forms plugin for WordPress (before version 3.15.4 ) is vulnerable to a server-side validation bypass in various list fields, including Checkbox List, Multi-Select List, Image List, Country, and State. The root cause is that NF_Abstracts_List falls through to a validate() method that fai...

CVE-2026-0740

CVE-2026-0740 : Ninja Forms - File Upload = 3.3.26 Unauthenticated Arbitrary File Upload. Description : The Ninja Forms - File Uploads plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due to missing file type validation and missing capability checks in the...

CVE-2023-37979

CVE-2023-37979 Unauth. Reflected Cross-Site Scripting XSS vulnerability in Saturday Drive Ninja Forms Contact Form plugin = 3.6.25 versions. PoC and Checker , for educational purposes only 'python3 exploit.py https://target.com'...

ninja-forms-brute

Ninja Forms 3.6.8 - Unauthenticated Email Address Disclosure Description The plugin does not delete the temporary files created when exporting submissions, which could allow unauthenticated attackers to download them and get sensitive information such as the email address of users who submitted a...

CVE-2026-0740

CVE-2026-0740 🧩 Overview CVE-2026-0740 is an unauthenticated arbitrary file upload vulnerability affecting: Ninja Forms File Uploads ≤ 3.3.26 WordPress plugin This flaw allows attackers to upload arbitrary files to the server without authentication, potentially leading to remote code execution RC...

PT-2026-128261

Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Checkbox List, Multi-Select List, Image List, Country, and State fields because NF Abstracts List falls through to a...

CVE-2019-10869

CVE-2019-10869 Wordpress Ninja Forms File Uploads Extension -----------------------------16345274557837-- Response: HTTP/1.1 200 OK Server: nginx/1.14.0 "data": "files": "name":"test.png.doc", "type":"application/msword", "tmpname":"nftmp-14FpD-test.png.doc", "erro...

CVE-2026-0740-mass

CVE-2026-0740 — Mass-Target Exploit Engine Author: 0xNuts Contributor: Cursor Repository: https://github.com/ExDev994/CVE-2026-0740-mass PoC for CVE-2026-0740: Ninja Forms File Uploads = 3.3.26 — Unauthenticated Arbitrary File Upload which can lead to RCE. Original vulnerability discovered by Sél...

CVE-2026-110899

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5...

CVE-2026-110899 WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5...