GCVE - cpe:2.3:a:unknown:ninja_forms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:ninja_forms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Ninja Forms (`ade88998-e65d-5871-86cf-c3ef43db4d52`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9083`	vulnerable	2026-06-08 07:45:21.668216	Ninja-forms < 3.11.1 - Unauthenticated PHP Objection The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. Published: 2025-09-18T06:00:06.472Z Updated: 2025-09-22T17:27:23.139Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/60b4d7fc-5d23-4dcf-bd7f-e202cabc2625/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2561`	vulnerable	2026-06-08 07:16:57.445843	Ninja Forms < 3.10.1 - Admin+ Stored XSS The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-19T06:00:05.777Z Updated: 2026-01-09T20:23:27.454Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/4a2074a3-a479-4473-92fb-04397f20dd86/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2560`	vulnerable	2026-06-08 07:16:57.445514	Ninja Forms < 3.10.1 - Admin+ Stored XSS The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-19T06:00:05.453Z Updated: 2026-01-09T20:24:12.270Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/2adaa55a-4a6d-40ca-ae19-fcb82420894a/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-2524`	vulnerable	2026-06-08 07:16:57.318311	Ninja Forms < 3.10.1 - Admin+ Stored XSS The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Published: 2025-05-19T06:00:05.132Z Updated: 2026-01-09T20:24:39.250Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/6e89ad2b-f12e-4b49-b34e-8da7d30629cd/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-14072`	vulnerable	2026-06-08 07:06:33.530011	Ninja Forms < 3.13.3 - Unauthenticated Token Generation and Submission Disclosure The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions. Published: 2026-01-02T06:00:12.069Z Updated: 2026-01-02T21:12:38.430Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/4b19a333-eb19-4903-aa96-1fe871dd0f9f/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-7354`	vulnerable	2026-06-08 06:58:22.005497	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.