Ninja Forms - File Uploads

Ninja Forms - File Uploads has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2026; 8 are fixed and 2 remain unpatched as of October 2026. Their average CVSS score is 7.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 6 high. 2026 was the busiest year with 6 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 4 of the records (40%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

8 of the records (80%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

9 independent researchers contributed these findings, most of them (2) reported by daroo.

Strategic Overview

Avg CVSSHigh

7.5/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Ninja Forms - File Uploads vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2026-81773

Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

10 records


2026-10-01 16:54	Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload Ninja Forms - File Uploads <= 3.3.34	`CVE-2026-92820`	8.1 High	daroo	Yes
2026-09-02 00:00	Ninja Forms - File Uploads <= 3.3.26 - Unauthenticated Stored Cross-Site Scripting Ninja Forms - File Uploads <= 3.3.26	`CVE-2026-81773`	7.2 High	Marc-André Beaulieu	No
2026-07-02 16:04	Ninja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints Ninja Forms - File Uploads <= 3.3.29	`CVE-2026-12557`	5.3 Medium	Ad4m5	Yes
2026-07-01 20:41	Ninja Forms - File Uploads <= 3.3.29 - Unauthenticated Arbitrary File Read via File Upload Field 'files[].data.file_path' Parameter Ninja Forms - File Uploads <= 3.3.29	`CVE-2026-13369`	7.5 High	daroo	Yes
2026-04-08 00:00	Ninja Forms File Uploads Extension <= 3.3.26 - Cross-Site Request Forgery Ninja Forms - File Uploads <= 3.3.26	`CVE-2026-57784`	4.3 Medium	Marc-André Beaulieu (h3dg3h0g)	No
2026-04-06 15:57	Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload Ninja Forms - File Uploads <= 3.3.26	`CVE-2026-0740`	9.8 Critical	Sélim Lanouar (whattheslime)	Yes
2024-09-06 00:00	Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload Ninja Forms - File Uploads <= 3.3.16	`CVE-2024-1596`	7.2 High	wesley (wcraft)	Yes
2021-11-20 00:00	Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting Ninja Forms - File Uploads <= 3.3.12	`CVE-2022-0889`	7.2 High	Nuno Correia (Blaze Security)	Yes
2020-03-20 00:00	Ninja Forms - File Uploads Extension <= 3.3.0 - Arbitrary File Upload Ninja Forms - File Uploads <= 3.3.0	`CVE-2022-0888`	9.8 Critical	Muhammad Zeeshan (Xib3rR4dAr)	Yes
2019-04-11 00:00	Ninja Forms - File Uploads <= 3.0.22 - Unauthenticated Arbitrary File Upload Ninja Forms - File Uploads < 3.0.23	`CVE-2019-10869`	8.1 High	Jasper Weijts	Yes

Showing 1–10 of 10 reports