Ninjaforms vulnerabilities
We track 4 vulnerabilities in Ninjaforms products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 17, 2025.
Latest Ninjaforms vulnerabilities
- 7.5 High severity
Ninja Forms – The Contact Form Builder That…: Authorization Bypass Through User-Controlled Key
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before th
- 7.2 High severity
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue…
Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24.
- 9.8 Critical severity
Ninja Forms – The Contact Form Builder That…: Improper Neutralization of Special Elements used in an SQL Command
The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient esc
- 7.2 High severity
Ninja Forms Contact Form – The Drag and Drop…: Deserialization of Untrusted Data
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on th