High
CVE-2026-90438
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 112
Reset filters
High
CVE-2026-92820
Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload
High
CVE-2026-102385
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-95515
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-91827
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
High
CVE-2026-92438
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-94504
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11363
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
High
CVE-2026-19769
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
Medium
CVE-2026-80437
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
Medium
CVE-2026-87870
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
High
CVE-2026-81773
Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting
Low
CVE-2026-80438
Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure
High
CVE-2026-81772
Ninja Forms - Layout & Styles <= 3.0.31 - Unauthenticated PHP Object Injection
Medium
CVE-2026-15256
Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-15663
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
Medium
CVE-2026-15161
Ninja Forms - Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter
Medium
CVE-2026-15160
Ninja Forms - Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal
Medium
CVE-2026-15159
Ninja Forms - Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter
Medium
CVE-2026-12557
Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
High
CVE-2026-13369
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
High
CVE-2026-1239
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Medium
CVE-2026-42741
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.