Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Release: Saturday Drive Ninja Forms 3.14.9 Clear all filters
TI-2026-46460 CVE-2026-65052 · GHSA-w952-x9hc-f66c

Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

Priority MEDIUM 44

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00581 Published 2026-07-21 Fixed in 3.14.9 CWE-472
TI-2026-46459 CVE-2026-65051 · GHSA-q572-6pwx-4p26

Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Priority LOW 37

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled fiel…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00491 Published 2026-07-21 Fixed in 3.14.9 CWE-602
TI-2026-46458 CVE-2026-65050 · GHSA-q35h-52xj-jfcj

Missing authorization in Saturday Drive Ninja Forms

Priority LOW 32

Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00437 Published 2026-07-21 Fixed in 3.14.9 CWE-862
TI-2026-46457 CVE-2026-65049 · GHSA-8235-3h67-fv4q

Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action

Priority LOW 37

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploi…

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00441 Published 2026-07-21 Fixed in 3.14.9 CWE-863
TI-2026-46456 CVE-2026-65048 · GHSA-895j-583x-29ww

Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index

Priority MEDIUM 43

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary stri…

CVSS 4.0CRITICAL 9.3 Network No auth User interaction EPSS 0.00538 Published 2026-07-21 Fixed in 3.14.9 CWE-79