VulnCheck KEV: CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-15663

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

EUVD-2026-48549

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-15663

The CVE covers Ninja Forms – The Contact Form Builder for WordPress, affected up to version 3.14.9. The vulnerability is a generic SQL Injection in the Import File settings key, caused by insufficient escaping and lack of parameterization in the call chain. Two sinks are implicated: _save_setting...

PT-2026-64272

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File 'settings' Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...

CVE-2026-65521

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

EUVD-2026-48123

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

CVE-2026-65521

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-65521.

CVE-2026-65521

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

CVE-2026-65521 WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Social Ninja = 4.3.0 versions...

EUVD-2026-48086

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

CVE-2026-65474

The CVE concerns WordPress Ninja Tables plugin

CVE-2026-65474

Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...

EUVD-2026-48181

Unauthenticated Cross Site Request Forgery CSRF in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-57784

CVE-2026-57784 : Unauthenticated Cross Site Request Forgery (CSRF) in the WordPress plugin Ninja Forms File Uploads Extension

WordPress WP Social Ninja plugin <= 4.3.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Social Ninja versions = 4.3.0...

CVE-2026-14291

The CVE-2026-14291 entry concerns the security-ninja-premium WordPress plugin (before 5.290). The issue is that one of the two-factor authentication (2FA) code paths does not verify the second factor, enabling an unauthenticated attacker who knows a user’s password to complete authentication with...

CVE-2026-14291 Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa

The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced...