Ninja Forms - File Uploads

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Ninja Forms - File Uploads

Information

Software Type Plugin
Software Slug ninja-forms-uploads
Software Status Active
Software Author SaturdayDrive
Software Website ninjaforms.com
Software Active Installs 57,944
Software Record Last Updated April 20, 2026

7 Vulnerabilities

Submit a Vulnerability
Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints
5.3
CVE-2026-12557
Jul 2, 2026
Researcher: Ad4m5
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter
7.5
CVE-2026-13369
Jul 1, 2026
Researcher: daroo
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
9.8
CVE-2026-0740
Apr 6, 2026
Researcher: Sélim Lanouar (whattheslime)
Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
7.2
CVE-2024-1596
Sep 6, 2024
Researcher: wesley (wcraft)
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
7.2
CVE-2022-0889
Nov 20, 2021
Researchers: Nuno Correia (Blaze Security), Muhammad Zeeshan (Xib3rR4dAr)
Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload
9.8
CVE-2022-0888
Mar 20, 2020
Researcher: Muhammad Zeeshan (Xib3rR4dAr)
Ninja Forms - File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload
8.1
CVE-2019-10869
Apr 11, 2019
Researcher: Jasper Weijts
Title Status CVE ID CVSS Researchers Date
Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints Patched CVE-2026-12557 5.3 Ad4m5 July 2, 2026
Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter Patched CVE-2026-13369 7.5 daroo July 1, 2026
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload Patched CVE-2026-0740 9.8 Sélim Lanouar (whattheslime) April 6, 2026
Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload Patched CVE-2024-1596 7.2 wesley (wcraft) September 6, 2024
Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting Patched CVE-2022-0889 7.2 Nuno Correia (Blaze Security), Muhammad Zeeshan (Xib3rR4dAr) November 20, 2021
Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload Patched CVE-2022-0888 9.8 Muhammad Zeeshan (Xib3rR4dAr) March 20, 2020
Ninja Forms - File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload Patched CVE-2019-10869 8.1 Jasper Weijts April 11, 2019

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation