CVE-2023-4109
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
The Ninja Forms plugin for WordPress before version 3.6.26 was affected by an HTML Injection security vulnerability.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious HTML code, potentially leading to data theft or takeover of the site.
Recommendation
It is recommended to update the Ninja Forms plugin to the latest version to mitigate this security vulnerability.
Other vulnerabilities in Ninja Forms WordPress plugin
See all- CVE-2026-80437Medium
The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site.
- CVE-2025-11924High
The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective.
Original NVD description (English source)
The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS