Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Ninja Forms 3.15.4 Clear all filters
TI-2026-62029 CVE-2026-91827 · GHSA-jvgp-rj42-qjww

Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export

Priority LOW 35

The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.00348 Published 2026-09-22 Fixed in 3.15.4 CWE-502
TI-2026-62341 CVE-2026-92438 · GHSA-x4cv-hqr7-5rcm

Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin

Priority MEDIUM 40

The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in the admin area, which could allow unauthenticated users to submit values through…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00394 Published 2026-09-22 Fixed in 3.15.4 CWE-79