Kstover
Vulnerability activity for Kstover: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 7
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 6.1MediumOct 31, 2026Kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder XSSCVE-2026-100151The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clic
- 7.2HighOct 31, 2026Kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder XSSCVE-2026-109997The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData.extra' parameter in all versions up to, and including, 3.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nf_ajax_submit endpoint issues a valid n
- 5.4MediumOct 31, 2026Kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder Code / command injectionCVE-2026-101326The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. Exploitation requires that an
- 6.5MediumOct 31, 2026Kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder Code / command injectionCVE-2026-100155The The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.15.5 This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- 7.2HighSep 22, 2026Kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder XSSCVE-2026-94504Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the WordPress admin origin.
- 6.6MediumSep 9, 2026Kstover Ninja Forms – The Contact Form Builder That Grows With You DeserializationCVE-2026-11363The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on
- 7.2HighSep 5, 2026Kstover Ninja Forms – The Contact Form Builder That Grows With You XSSCVE-2026-19769The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads
Top products
- Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder5 CVEs in the last year
- Ninja Forms – The Contact Form Builder That Grows With You2 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.