PatchTheCVEninja forms vulnerabilities and fixes
Recent CVEs affecting ninja forms, with upgrade or downgrade steps. 19 tracked.
Also searched as: ninjaforms.
ninja forms has 19 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 19. Most recent: 2026-01-02. Highest priority: CVE-2025-9083 (score 59/100).
- CVE-2025-10498 MEDIUM 4.3 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Sit
- CVE-2025-10499 MEDIUM 4.3 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Sit
- CVE-2025-11924 HIGH 7.5 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure
- CVE-2025-9083 CRITICAL 9.8 UPGRADE The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unau
- CVE-2025-5398 MEDIUM 6.4 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cr
- CVE-2025-2561 MEDIUM 4.8 UPGRADE The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could
- CVE-2025-2560 MEDIUM 4.8 UPGRADE The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could
- CVE-2025-2524 MEDIUM 4.8 UPGRADE The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could
- CVE-2025-14072 MEDIUM 5.3 UPGRADE The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access toke
- CVE-2024-7354 MEDIUM 6.1 UPGRADE The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribu
- CVE-2024-50515 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin St
- CVE-2024-50514 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin St
- CVE-2024-43999 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in S
- CVE-2024-3866 MEDIUM 4.7 UPGRADE The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting v
- CVE-2024-39628 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forger
- CVE-2024-37934 MEDIUM 5.4 UPGRADE Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows C
- CVE-2024-13470 MEDIUM 6.4 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cr
- CVE-2024-12238 MEDIUM 6.3 UPGRADE The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbit
- CVE-2024-11052 HIGH 7.2 UPGRADE The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cr
FAQ
How do I fix ninja forms vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ninja forms being exploited right now?
None of the tracked ninja forms CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ninja forms CVE should I patch first?
CVE-2025-9083 currently ranks highest (59/100): The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unau.