Ninja Forms File Uploads
Approved changes feed: RSS · Atom
cpe:2.3:a:ninjaforms:ninja_forms_file_uploads:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Ninjaforms (f64b2f64-26fb-514e-8b4b-dbb0eb3f969e) |
|---|---|
| Product | Ninja Forms File Uploads (ca454815-3e69-559b-975b-4ffa0f94aa86) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1596 |
vulnerable | 2026-06-08 06:27:13.696682 |
Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
HIGH (7.2)
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Published: 2024-09-07T11:17:02.559Z
Updated: 2026-04-08T16:50:32.548Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0889 |
vulnerable | 2026-06-08 05:39:11.422495 |
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
HIGH (7.2)
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Published: 2022-03-23T19:46:49.000Z
Updated: 2026-04-08T17:05:57.998Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-0888 |
vulnerable | 2026-06-08 05:39:11.421978 |
Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
CRITICAL (9.8)
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Published: 2022-03-23T19:46:51.000Z
Updated: 2026-04-08T17:32:10.389Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-10869 |
vulnerable | 2026-06-08 05:12:25.358457 |
Details available
Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.
Published: 2019-05-07T17:07:57.000Z
Updated: 2026-08-17T17:23:04.844Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.