1308 matches found
CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...
CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...
CVE-2026-92820
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...
EUVD-2026-91175
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...
CVE-2026-92820: Unrestricted Upload of File with Dangerous Type
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...
PT-2026-104081
Name of the Vulnerable Software and Affected Versions Ninja Forms – The Contact Form Builder That Grows With You versions prior to 3.15.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping during Paragraph Text field submissions...
PT-2026-104083
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file path,...
CVE-2026-90438: Improper Neutralization of Input During Web Page Generation
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...
WordPress Ninja Forms plugin <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission vulnerability
Unauthenticated Stored Cross-Site Scripting via Paragraph Text RTE Field Submission vulnerability discovered by UKO - Korea univ. in WordPress Plugin Ninja Forms versions = 3.15.4...
WordPress Ninja Forms - File Uploads plugin <= 3.3.34 - Unauthenticated Arbitrary File Upload vulnerability
WordPress Ninja Forms - File Uploads plugin = 3.3.34 - Unauthenticated Arbitrary File Upload vulnerability discovered by daroo in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.34...
CVE-2026-102385
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-102385 WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-102385
The Ninja Forms WordPress plugin versions
EUVD-2026-89941
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Ninja Forms versions = 3.15.3...
CVE-2026-102385: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
PT-2026-103140
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
cve-2026-94504
cve-2026-94504 Ninja Forms unauth stored XSS POC Ninja Forms ≤ 3.15.3 — unauthenticated stored XSS. A public non-RTE textarea is saved, then htmlentitydecode'd and written into the legacy submission editor with no esctextarea. 3.15.4 escapes it. No login is required to plant the payload. It runs...
