CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363

CVE-2026-11363 affects the Ninja Forms WordPress plugin (all versions ≤ 3.14.6) with an authenticated PHP Object Injection vulnerability. During form import, WPN_Helper::build_nf_cache() calls $action-&gt;get_settings(), triggering deserialization of untrusted input with no further user interacti...

CVE-2026-11363 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

EUVD-2026-74608

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

PT-2026-88788

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-11363: Deserialization of Untrusted Data

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

WordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection vulnerability

Authenticated Administrator+ PHP Object Injection vulnerability discovered by Hermione in WordPress Plugin Ninja Forms versions = 3.14.6...

WordPress Ninja Forms - Scheduled Exports plugin <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters vulnerability

WordPress Ninja Forms - Scheduled Exports plugin = 3.0.3 - Authenticated Subscriber+ Stored Cross-Site Scripting via REST API Parameters vulnerability discovered by Nguyen Truong Roll in WordPress Plugin Ninja Forms - Scheduled Exports versions = 3.0.3...

CVE-2026-80437

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

EUVD-2026-72092

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

CVE-2026-80437

Ninja Forms WordPress plugin versions 3.14.10 through before 3.15.2 are affected by an unauthenticated arbitrary shortcode execution vulnerability. The plugin fails to sanitize shortcodes in request-derived values (IP and Referer merge tags) before substituting them into content that is later pro...

CVE-2026-80437 Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

CVE-2026-80437 Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

WordPress Ninja Forms plugin 3.14.10-3.15.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Ninja Forms versions 3.14.10-3.15.1...

PT-2026-86506

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

CVE-2026-80437: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

EUVD-2026-71992

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550 Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook

The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulkactions' function. This makes it possible for authenticated attackers, with...

CVE-2026-15550

The Ninja Forms – Save Progress WordPress plugin (versions ≤ 3.0.30) is affected by a missing authorization flaw rooted in the absence of capability checks and nonce verification within the bulk_actions function. Authenticated users holding subscriber-level or higher permissions can leverage this...

WordPress Ninja Forms - Save Progress plugin <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook vulnerability

WordPress Ninja Forms - Save Progress plugin = 3.0.30 - Missing Authorization to Authenticated Subscriber+ Arbitrary Data Deletion via admin-ajax.php with admininit Hook vulnerability discovered by Hermione in WordPress Plugin Ninja Forms - Save Progress versions = 3.0.30...