Ninja Forms Security Vulnerabilities and Issues — Ninja Forms CVE List

Lucene search

NinjaformsNinja Forms

5 matches found

CVE•added 2025/01/30 8:15 a.m.•42 views

CVE-2024-13470

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

6.4CVSS5.7AI score0.00042EPSS

CVE•added 2025/05/19 6:15 a.m.•20 views

CVE-2025-2524

The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

4.8CVSS5.4AI score0.00046EPSS

CVE•added 2025/05/19 6:15 a.m.•17 views

CVE-2025-2561

4.8CVSS5.4AI score0.00046EPSS

CVE•added 2025/05/19 6:15 a.m.•14 views

CVE-2025-2560

4.8CVSS5.4AI score0.00046EPSS

CVE•added 2025/06/27 10:15 a.m.•10 views

CVE-2025-5398

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes...

6.4CVSS5.8AI score0.00029EPSS