Ninja Forms Ninja Forms

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.

The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.

WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack

Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure

Ninja Forms < 3.6.34 - Admin+ Stored XSS

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import

Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting

WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Ninja Forms < 3.10.1 - Admin+ Stored XSS

Ninja Forms < 3.10.1 - Admin+ Stored XSS

Ninja Forms < 3.10.1 - Admin+ Stored XSS

Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php.

Ninja Forms < 3.4.34.1 - Authenticated OAuth Connection Key Disclosure

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update