Ninja Forms plugin for WordPress versions before 3.15.4 contains a vulnerability where unauthenticated attackers can submit crafted formula payloads to certain list fields via the nf_ajax_submit endpoint. This bypasses CSV escaping protections applied only to Textbox and Textarea fields, leading to CSV injection when an administrator downloads and opens exported submission files.
The Ninja Forms - File Uploads plugin for WordPress up to version 3.3.34 contains a vulnerability allowing unauthenticated attackers to perform arbitrary file read, write, and deletion operations via the external Amazon S3 upload flow. This occurs because the plugin trusts attacker-supplied file paths without validation, which can lead to remote code execution if the external store is configured. Exploitation requires the use of the External File Upload (Amazon S3) action, and for file read, an Email action attaching the uploaded file must be configured. A patch is available to address this issue.
The Ninja Forms - Scheduled Exports WordPress plugin up to version 3.0.3 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of REST API parameters (interval, format, emailTo). Authenticated users with subscriber-level privileges or higher can exploit this to inject malicious scripts that execute when other users view the affected pages. The REST endpoint lacks proper permission checks beyond nonce validation, increasing risk.
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions.
Ninja Forms WordPress plugin version 3.14.8 and earlier contains an input validation vulnerability that allows unauthenticated attackers to manipulate form calculation and payment totals. By submitting values not matching configured ListSelect or ListRadio options, attackers can cause the calculation method to return attacker-controlled numeric values, enabling arbitrary payment amount manipulation.
Ninja Forms WordPress plugin version 3.14.8 has a vulnerability where client-side enforcement of server-side security can be bypassed by unauthenticated attackers. This allows attackers to override form field metadata before validation, disabling required fields and CAPTCHA checks. The vulnerability can be exploited via the nopriv AJAX endpoint to submit malicious data that triggers form actions like email notifications and database storage without proper validation.
Ninja Forms WordPress plugin version 3.14.8 and earlier contains a missing authorization vulnerability in the render callback of the ninja-forms/submissions-table Gutenberg block. This flaw allows authenticated users with Author-level privileges to expose stored form submissions to unauthenticated visitors by embedding the block with an arbitrary formID on a published post. Attackers can then retrieve a signed bearer token from visitors' browsers and use it to access sensitive form submission data via the REST API, including personally identifiable information such as names, emails, and phone numbers.
Ninja Forms plugin for WordPress Multisite versions 3.14.8 and earlier contains an incorrect authorization vulnerability. This flaw allows a subsite Administrator to delete all Ninja Forms data network-wide by exploiting improper capability checks and unsafe multisite migration defaults. An attacker can send a crafted POST request to the admin-ajax.php endpoint to trigger deletion routines that affect every subsite without needing super-admin privileges. The vulnerability has a high severity rating with a CVSS score of 8.4.
Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains a critical unauthenticated stored cross-site scripting (XSS) vulnerability in its Repeatable Fieldset feature. The vulnerability arises because the parseSubmissionIndex() function accepts arbitrary strings without numeric validation, and admin_form_element() inserts these strings into HTML without escaping. An attacker can exploit this by submitting a crafted form that injects malicious scripts, which execute in the administrator's browser when viewing submissions. This can lead to session cookie theft, unauthorized creation of administrator accounts, installation of malicious plugins, and arbitrary site content modification.
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file.
The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entries stored in the wp_nf3_log table or permanently delete all rows from that table.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a client-supplied saveProgress flag, bypassing all upload validation, path normalization, and database record creation steps, and allowing an attacker-supplied file_path value to reach wp_mail() as an email attachment with only a file_exists() check. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability was partially patched in version 3.3.25 and fully patched in version 3.3.27.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6.