The Ninja Forms - Save Progress plugin for WordPress has a Missing Authorization vulnerability in versions up to 3.0.30. Authenticated attackers with subscriber-level access can delete arbitrary database records from the 'wp_nf3_objects' table, such as saved submissions. This issue arises from the lack of capability checks and nonce verification in the 'bulk_actions' function. To verify and mitigate, defe [truncated]
A vulnerability exists in Ninja Forms - Layout & Styles plugin versions <= 3.0.31, allowing unauthenticated PHP object injection. The CVE record was published on 2026-09-02T12:17:13.287Z and was last modified on 2026-09-03T14:17:01.987Z. The NVD entry is currently Deferred.
The Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability, allowing unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals. This vulnerability can be exploited by tampering with form submission payloads to the ajax submit endpoint, causing the get_calc_value() method to fail open and return attacker-control [truncated]
