Skip to content
OpenAdvisories

Product · Saturday Drive

Ninja Forms

16 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-65051

    Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

    Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form defi…

    Saturday Drive Ninja Forms Web / CMS
  • Medium 6.5
    CVE-2026-65050

    Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors

    Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privileges to expose store…

    Saturday Drive Ninja Forms Web / CMS
  • Medium 5.9
    CVE-2024-43999

    WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.

    Saturday Drive Ninja Forms
  • Medium 5.4
    CVE-2024-39628

    WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.

    Saturday Drive Ninja Forms
  • Medium 5.4
    CVE-2024-37934

    WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4.

    Saturday Drive Ninja Forms
  • Medium 5.4
    CVE-2024-26019

    Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is…

    Saturday Drive Ninja Forms
  • Medium 6.1
    CVE-2024-29220

    Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerabi…

    Saturday Drive Ninja Forms
  • Medium 6.5
    CVE-2021-34647

    Ninja Forms <= 3.5.7 Sensitive Information Disclosure

    The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to expo…

    Saturday Drive Ninja Forms Web / CMS
  • Medium 6.4
    CVE-2021-34648

    Ninja Forms <= 3.5.7 Unprotected REST-API to Email Injection

    The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary e…

    Saturday Drive Ninja Forms Web / CMS