Ninja Forms The Contact Form Builder That Grows With You
Monthly
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Ninja Forms WordPress plugin (all versions through 3.14.1) lets unauthenticated remote attackers read stored form submissions via the 'ninja-forms-views/token/refresh' REST callback, which lacks an authorization check. Because Ninja Forms submissions frequently capture PII, contact details, and other sensitive user-entered data, this exposes potentially confidential information to anyone who can reach the site. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-auth nature makes it straightforward to abuse.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Ninja Forms plugin for WordPress versions up to 3.14.1 exposes authorization tokens via an insecure callback function in blocks/bootstrap.php, allowing authenticated Contributor-level users and above to access form submission data from arbitrary forms without proper authorization. The vulnerability enables sensitive information disclosure affecting all WordPress installations using the affected plugin versions, with no active exploitation confirmed at time of analysis.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Broken access control in the Ninja Forms WordPress plugin (all versions through 3.14.1) lets unauthenticated remote attackers read stored form submissions via the 'ninja-forms-views/token/refresh' REST callback, which lacks an authorization check. Because Ninja Forms submissions frequently capture PII, contact details, and other sensitive user-entered data, this exposes potentially confidential information to anyone who can reach the site. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-auth nature makes it straightforward to abuse.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Ninja Forms plugin for WordPress versions up to 3.14.1 exposes authorization tokens via an insecure callback function in blocks/bootstrap.php, allowing authenticated Contributor-level users and above to access form submission data from arbitrary forms without proper authorization. The vulnerability enables sensitive information disclosure affecting all WordPress installations using the affected plugin versions, with no active exploitation confirmed at time of analysis.