VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 76 known issues Latest disclosed Mar 27, 2026

Ninja Forms – The Contact Form Builder That Grows With You Vulnerabilities

Review known vulnerability records for the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You (`ninja-forms`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
76
High or Critical
22
Patch Coverage
100%
Last Updated
Mar 28, 2026
Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Ninja Forms – The Contact Form Builder That Grows With You so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
76 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
4 critical and 18 high severity findings.
Recent CVEs
CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Ninja Forms – The Contact Form Builder That Grows With You

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-1307
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This make...

Published
Mar 27, 2026
Patched Release
3.14.2
Affected Versions
Versions up to 3.14.1
Next Step
Update to 3.14.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resoluti...

Published
Feb 09, 2026
Patched Release
3.14.1
Affected Versions
Versions up to 3.14.0
Next Step
Update to 3.14.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-11924
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views...

Published
Dec 16, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-14072
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /ninja-forms-views/token/refresh function in all versions up to, and including, 3.13.2. This makes it possible...

Published
Dec 12, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10499
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possibl...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10498
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unau...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-9083
Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.11.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Obje...

Published
Aug 28, 2025
Patched Release
3.11.1
Affected Versions
Versions up to 3.11.0
Next Step
Update to 3.11.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5398
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the t...

Published
Jun 26, 2025
Patched Release
3.10.2.2
Affected Versions
Versions up to 3.10.2.1
Next Step
Update to 3.10.2.2 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2560
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2524
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2561
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open Full Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13470
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied att...

Published
Jan 29, 2025
Patched Release
3.8.25
Affected Versions
Versions up to 3.8.24
Next Step
Update to 3.8.25 or newer if supported.
Open Full Report Open CVE Reference