kstover vulnerabilities

CVEs per yearBy the year they were published

1. 20246
2. 20255
3. 202612

Newest CVEs

• CVE-2026-100151

  Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  Medium6.1
• CVE-2026-100155

  Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  Medium6.5
• CVE-2026-109997

  Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  High7.2
• CVE-2026-101326

  Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  Medium5.4
• CVE-2026-90438

  Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  High7.2
• CVE-2026-94504

  Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

  kstover · Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

  High7.2
• CVE-2026-11363

  Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import

  kstover · Ninja Forms – The Contact Form Builder That Grows With You

  Medium6.6
• CVE-2026-19769

  Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key

  kstover · Ninja Forms – The Contact Form Builder That Grows With You

  High7.2
• CVE-2026-15663

  Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

  kstover · Ninja Forms – The Contact Form Builder That Grows With You

  Medium4.9
• CVE-2026-1239

  Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

  kstover · Ninja Forms – The Contact Form Builder That Grows With You

  High7.5