# Ninjaforms Ninja Forms


- [CVE-2025-9083](https://insights.sbomify.com/CVE-2025-9083/): Ninja-forms < 3.11.1 - Unauthenticated PHP Objection (critical 9.8)
- [CVE-2016-1209](https://insights.sbomify.com/CVE-2016-1209/): Deserialization in n/a (critical 9.8)
- [CVE-2018-20981](https://insights.sbomify.com/CVE-2018-20981/): Information disclosure in n/a (critical 9.1)
- [CVE-2024-25572](https://insights.sbomify.com/CVE-2024-25572/): Cross-site request forgery in Ninja Forms (high 8.8)
- [CVE-2021-24163](https://insights.sbomify.com/CVE-2021-24163/): Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure (high 8.8)
- [CVE-2018-16308](https://insights.sbomify.com/CVE-2018-16308/): Other in n/a (high 8.6)
- [CVE-2023-38386](https://insights.sbomify.com/CVE-2023-38386/): WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability (high 7.6)
- [CVE-2023-38393](https://insights.sbomify.com/CVE-2023-38393/): WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability (high 7.6)
- [CVE-2025-11924](https://insights.sbomify.com/CVE-2025-11924/): Missing authorization in Ninja Forms – The Contact Form Builder That Grows With You (high 7.5)
- [CVE-2018-20980](https://insights.sbomify.com/CVE-2018-20980/): Business logic in n/a (high 7.5)
- [CVE-2014-9688](https://insights.sbomify.com/CVE-2014-9688/): Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users. (high 7.5)
- [CVE-2024-11052](https://insights.sbomify.com/CVE-2024-11052/): Cross-site scripting in Ninja Forms – The Contact Form Builder That Grows With You (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/products/ninjaforms/ninja-forms/