Ninja Forms Uploads Vulnerabilities

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read all plugin debug log entri...

CVSS:

5.3

Affected:

up to 3.3.29

Fixed in:

3.3.30

Disclosed:

Jul 2, 2026

CVE-2026-12557 on NVD →

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the process() method returns early due to a cli...

CVSS:

7.5

Affected:

up to 3.3.29

Fixed in:

3.3.30

Disclosed:

Jul 1, 2026

CVE-2026-13369 on NVD →

The Ninja Forms File Uploads Extension plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.26. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged reques...

CVSS:

4.3

Affected:

up to 3.3.26

Fix:

No patched version reported

Disclosed:

Apr 8, 2026

CVE-2026-57784 on NVD →

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all versions up to, and including, 3.3.26. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVSS:

9.8

Affected:

up to 3.3.26

Fixed in:

3.3.27

Disclosed:

Apr 6, 2026

CVE-2026-0740 on NVD →

[en] The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Affected:

up to 3.3.18

Fixed in:

3.3.18

Disclosed:

Sep 7, 2024

CVE-2024-1596 on NVD →

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:

7.2

Affected:

up to 3.3.16

Fixed in:

3.3.18

Disclosed:

Sep 6, 2024

CVE-2024-1596 on NVD →

[en] The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable W...

Affected:

up to 3.3.13

Fixed in:

3.3.13

Disclosed:

Mar 23, 2022

CVE-2022-0889 on NVD →

[en] The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be use...

Affected:

up to 3.3.1

Fixed in:

3.3.1

Disclosed:

Mar 23, 2022

CVE-2022-0888 on NVD →

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPr...

CVSS:

7.2

Affected:

up to 3.3.12

Fixed in:

3.3.13

Disclosed:

Nov 20, 2021

CVE-2022-0889 on NVD →

The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to...

CVSS:

9.8

Affected:

up to 3.3.0

Fixed in:

3.3.1

Disclosed:

Mar 20, 2020

CVE-2022-0888 on NVD →

[en] Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name paramet...

Affected:

up to 3.0.23

Fixed in:

3.0.23

Disclosed:

May 7, 2019

CVE-2019-10869 on NVD →

Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters.

CVSS:

8.1

Affected:

up to 3.0.23

Fixed in:

3.0.23

Disclosed:

Apr 11, 2019

CVE-2019-10869 on NVD →