VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 75 known issues Latest disclosed Feb 09, 2026

Ninja Forms – The Contact Form Builder That Grows With You Vulnerabilities

Review known vulnerability records for the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You (`ninja-forms`), including severity, CVE references, affected versions, and patch status.

View on WordPress.org Back to Feed
Known Records
75
High or Critical
22
Linked CVEs
63
Last Updated
Feb 10, 2026
Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Ninja Forms – The Contact Form Builder That Grows With You so operators can quickly confirm whether a disclosed issue maps to the installed slug and version range.

Patch Visibility
75 records include a published patch path.
Severity Mix
4 critical and 18 high severity findings.
Reference Workflow
Jump from the hub into the full report when you need remediation notes, CVSS vector details, or source references.
Known Vulnerabilities

Reports for Ninja Forms – The Contact Form Builder That Grows With You

Sorted by latest disclosure date so newly published issues surface first.

Plugin High Patched: Yes CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resoluti...

Published
Feb 09, 2026
Patched Release
3.14.1
Affected Versions
Versions up to 3.14.0
Next Step
Update to 3.14.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-11924
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views...

Published
Dec 16, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-14072
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /ninja-forms-views/token/refresh function in all versions up to, and including, 3.13.2. This makes it possible...

Published
Dec 12, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10499
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possibl...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10498
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unau...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-9083
Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.11.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Obje...

Published
Aug 28, 2025
Patched Release
3.11.1
Affected Versions
Versions up to 3.11.0
Next Step
Update to 3.11.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5398
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the t...

Published
Jun 26, 2025
Patched Release
3.10.2.2
Affected Versions
Versions up to 3.10.2.1
Next Step
Update to 3.10.2.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2560
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2524
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2561
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13470
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied att...

Published
Jan 29, 2025
Patched Release
3.8.25
Affected Versions
Versions up to 3.8.24
Next Step
Update to 3.8.25 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-12238
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution

The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a v...

Published
Dec 28, 2024
Patched Release
3.8.23
Affected Versions
Versions up to 3.8.22
Next Step
Update to 3.8.23 or newer if supported.
Open Full Report Open CVE Reference