CVE-2025-10499mediumCWE-352

CVE-2025-10499: fallo de gravedad media en kstover Ninja Forms – The Contact Form Builder…

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Ninja Forms – The Contact Form Builder That Grows With You

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.3epss 0.2%
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
kstover · Ninja Forms – The Contact Form Builder That Grows With You
CVEs relacionadas — kstover Ninja Forms – The Contact Form Builder…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-11363MEDIUMNinja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form ImportEPSS 0.9%CVE-2024-0685MEDIUMNinja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL InjectionEPSS 0.8%CVE-2026-15663MEDIUMNinja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' KeyEPSS 0.5%CVE-2024-12238MEDIUMNinja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode ExecutionEPSS 0.5%CVE-2026-1239HIGHNinja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST EndpointEPSS 0.5%CVE-2025-11924HIGHNinja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer TokenEPSS 0.4%