Exposición de Ninja Forms

Form builders, WordPress plugins
38
score de exposición
12.835
sitios usan
0
en explotación
2
críticos
Análisis Vexday

O histórico de vulnerabilidades do Ninja Forms reúne 18 CVEs catalogadas, com taxa de exploração ativa em zero — abaixo da média geral do catálogo CISA KEV —, o que indica ausência de exploração confirmada no momento, embora não elimine o risco latente. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), padrão frequente em plugins WordPress e que exige atenção especial em ambientes com múltiplos usuários autenticados. A CVE mais perigosa atualmente referenciada é CVE-2021-34647, com score EPSS de 0,01122, sugerindo probabilidade de exploração ainda baixa, mas não desprezível. O único CVE de severidade crítica no conjunto e a ausência de novas vulnerabilidades nos últimos 90 dias indicam um perfil estável no curto prazo, mas equipes de segurança devem manter o plugin atualizado dado o histórico acumulado de falhas de injeção de conteúdo.

CVEs

23 resultados
CVE-2021-34647MEDIUMNinja Forms <= 3.5.7 Sensitive Information DisclosureEPSS 1.2%CVE-2024-7354MEDIUMNinja Forms 3.8.6-3.8.10 - Reflected XSSEPSS 0.7%CVE-2021-34648MEDIUMNinja Forms <= 3.5.7 Unprotected REST-API to Email InjectionEPSS 0.7%CVE-2023-38393HIGHWordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-26019MEDIUMNinja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrEPSS 0.5%CVE-2025-9083CRITICALNinja-forms < 3.11.1 - Unauthenticated PHP ObjectionEPSS 0.5%CVE-2023-38386HIGHWordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerabilityEPSS 0.5%CVE-2024-37934MEDIUMWordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerabilityEPSS 0.5%CVE-2024-29220MEDIUMNinja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, anEPSS 0.5%CVE-2024-50515MEDIUMWordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2024-50514MEDIUMWordPress Ninja Forms – The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.4%CVE-2026-65052HIGHNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsEPSS 0.4%CVE-2026-65050HIGHNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated VisitorsEPSS 0.3%CVE-2025-14072MEDIUMNinja Forms < 3.13.3 - Unauthenticated Token Generation and Submission DisclosureEPSS 0.3%CVE-2026-65048CRITICALNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission IndexEPSS 0.3%CVE-2024-25572HIGHCross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page whiEPSS 0.3%CVE-2024-43999MEDIUMWordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-65051MEDIUMNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerEPSS 0.3%CVE-2025-2524MEDIUMNinja Forms < 3.10.1 - Admin+ Stored XSSEPSS 0.3%CVE-2026-65049HIGHNinja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX ActionEPSS 0.3%