VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 76 known issues Latest disclosed Mar 27, 2026

Ninja Forms – The Contact Form Builder That Grows With You Vulnerabilities

Review known vulnerability records for the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You (`ninja-forms`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
76
High or Critical
22
Patch Coverage
100%
Last Updated
Apr 13, 2026
Priority CVE Quick Links

Fast paths into Ninja Forms – The Contact Form Builder That Grows With You CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
64
CVE-2019-15025 Critical 3.3.21.2
CVE-2019-15025 Ninja Forms – The Contact Form Builder That Grows With You SQL Injection

Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection

CVE-2016-1209 Critical 2.9.42.1
CVE-2016-1209 Ninja Forms – The Contact Form Builder That Grows With You Arbitrary File Upload

Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload

CVE-2018-20981 Critical 3.3.9
CVE-2018-20981 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests

CVE-2021-24163 High 3.4.34
CVE-2021-24163 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

CVE-2020-36174 High 3.4.27.1
CVE-2020-36174 Ninja Forms – The Contact Form Builder That Grows With You Cross-Site Request Forgery

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation

CVE-2018-16308 High 3.3.14
CVE-2018-16308 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form <= 3.3.13 - CSV Injection

CVE-2025-9083 High 3.11.1
CVE-2025-9083 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

CVE-2016-1209 High 2.9.42.1
CVE-2016-1209 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Ninja Forms – The Contact Form Builder That Grows With You so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
76 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
4 critical and 18 high severity findings.
Recent CVEs
CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

CVE-2025-11924 High Patch path listed

CVE-2025-11924: Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to...

Published
Dec 16, 2025
Patch Status
3.13.3
Open CVE-2025-11924 Report
Known Vulnerabilities

Reports for Ninja Forms – The Contact Form Builder That Grows With You

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-1307
CVE-2026-1307: Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This make...

Published
Mar 27, 2026
Patched Release
3.14.2
Affected Versions
Versions up to 3.14.1
Next Step
Update to 3.14.2 or newer if supported.
Open CVE-2026-1307 Report Open CVE Reference
Plugin High Patched: Yes CVE-2026-2268
CVE-2026-2268: Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resoluti...

Published
Feb 09, 2026
Patched Release
3.14.1
Affected Versions
Versions up to 3.14.0
Next Step
Update to 3.14.1 or newer if supported.
Open CVE-2026-2268 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-11924
CVE-2025-11924: Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views...

Published
Dec 16, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open CVE-2025-11924 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-14072
CVE-2025-14072: Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /ninja-forms-views/token/refresh function in all versions up to, and including, 3.13.2. This makes it possible...

Published
Dec 12, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Open CVE-2025-14072 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10499
CVE-2025-10499: Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possibl...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open CVE-2025-10499 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10498
CVE-2025-10498: Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unau...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Open CVE-2025-10498 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-9083
CVE-2025-9083: Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.11.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Obje...

Published
Aug 28, 2025
Patched Release
3.11.1
Affected Versions
Versions up to 3.11.0
Next Step
Update to 3.11.1 or newer if supported.
Open CVE-2025-9083 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5398
CVE-2025-5398: Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the t...

Published
Jun 26, 2025
Patched Release
3.10.2.2
Affected Versions
Versions up to 3.10.2.1
Next Step
Update to 3.10.2.2 or newer if supported.
Open CVE-2025-5398 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2560
CVE-2025-2560: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open CVE-2025-2560 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2524
CVE-2025-2524: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open CVE-2025-2524 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2561
CVE-2025-2561: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Open CVE-2025-2561 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13470
CVE-2024-13470: Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied att...

Published
Jan 29, 2025
Patched Release
3.8.25
Affected Versions
Versions up to 3.8.24
Next Step
Update to 3.8.25 or newer if supported.
Open CVE-2024-13470 Report Open CVE Reference