CVE-2024-1596: high-severity vulnerability in SaturdayDrive Ninja Forms - File Uploads
Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.2epss 0.4%
exploitation probability
0.4%top 65% of all CVEs
observed exploitation
nono source reports it
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
SaturdayDrive · Ninja Forms - File UploadsRelated CVEs — SaturdayDrive Ninja Forms - File Uploads
In the same product, most dangerous first.
CVE-2026-0740CRITICALNinja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadEPSS 62.9%CVE-2022-0888CRITICALNinja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File UploadEPSS 39.4%CVE-2022-0889HIGHNinja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site ScriptingEPSS 0.8%CVE-2026-13369HIGHNinja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' ParameterEPSS 0.6%CVE-2026-92820HIGHNinja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File UploadEPSS 0.5%CVE-2026-12557MEDIUMNinja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST EndpointsEPSS 0.4%