Saturday Drive
Monthly
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the `ninja-forms/submissions-table` Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via `wp_localize_script`, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.
Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
PHP Object Injection in the Ninja Forms - Layout & Styles WordPress plugin (versions ≤ 3.0.31) exposes sites to unauthenticated remote code execution through unsafe deserialization of attacker-controlled PHP objects. Classified under CWE-502 (Deserialization of Untrusted Data), the flaw allows a crafted serialized payload to trigger property-oriented programming gadget chains already present in the WordPress plugin environment, yielding full confidentiality, integrity, and availability compromise of the affected server. No active exploitation has been confirmed in the CISA KEV catalog, but the unauthenticated network attack path and high-impact triad (C:H/I:H/A:H) demand immediate remediation across all affected WordPress deployments.
Payment and calculation total tampering in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) allows unauthenticated attackers to submit crafted values that match no configured option in ListSelect or ListRadio fields, causing the get_calc_value() method to fail open and return attacker-supplied numbers. This lets an attacker rewrite form calculation results and payment amounts - including setting order totals to zero - bypassing admin-defined pricing logic. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and this is not listed in CISA KEV.
Broken authorization in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets an authenticated Author-level user expose stored form submissions to any unauthenticated site visitor by embedding the `ninja-forms/submissions-table` Gutenberg block with an arbitrary formID on a published post. Because the block's render callback performs no capability check and injects a signed bearer token into every visitor's browser via `wp_localize_script`, anyone loading the page can replay that token against the REST submissions endpoint and read all saved field values, including PII such as names, emails, and phone numbers. Reported by VulnCheck; a vendor patch is available, but no public exploit code was identified at time of analysis and the flaw is not in CISA KEV - no public exploit identified at time of analysis.
Network-wide data destruction in the Ninja Forms WordPress plugin (versions 3.14.8 and prior) lets a low-privilege subsite Administrator wipe all Ninja Forms data across an entire Multisite network. By abusing a site-scoped capability check paired with unsafe multisite migration defaults, an actor who reaches the nf_delete_all_data admin-ajax action with a valid per-site nonce triggers migration routines that iterate every blog and drop all nf3_* tables plus related options and transients - no super-admin or network-admin rights needed. Reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.
Missing authorization in the Ninja Forms - Save Progress WordPress plugin (versions ≤3.0.30) allows any subscriber-level authenticated user to bulk-delete arbitrary records from the wp_nf3_objects database table via the unprotected bulk_actions function. The handler enforces neither WordPress capability checks nor nonce verification, meaning any logged-in site user can destroy saved form submission data at will. No public exploit has been identified at the time of analysis; CVSS 4.3 reflects the constrained, integrity-only impact gated behind authentication.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.