WordPress plugin · ninja-forms
Is Ninja Forms safe?
Safe on 3.15.7 or newer.
The current version, 3.15.7, is past every affected range on record (72 of 77 records list one; 5 don’t, so check those below). Keep it updated and you’re clear of them.
- Flaws on record
- 77
- High or critical
- 27
- Exploited
- none
- Current version
- 3.15.7
- Last updated
- Oct 26, 2026
- Active installs
- 500,000+
Every recorded flaw
- Oct 28, 2026Ninja Forms: Incomplete server-side validationCVE-2026-67187 · fixed in 3.15.4 · reported by VulnCheckMedium 5.1
- Oct 21, 2026Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-110899 · affects up to 3.15.5 · reported by PatchstackHigh 7.1
- Oct 2, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-90438 · affects up to 3.15.4 · reported by WordfenceHigh 7.2
- Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-102385 · affects up to 3.15.3 · reported by PatchstackHigh 7.1
- Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.CVE-2026-95515 · affects up to 3.15.3 · reported by PatchstackHigh 7.1
- Sep 22, 2026Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor.CVE-2026-94504 · reported by WordfenceHigh 7.2
- Sep 9, 2026Ninja Forms – The Contact Form Builder That Grows With You: PHP Object InjectionCVE-2026-11363 · affects up to 3.14.6 · reported by WordfenceMedium 6.6
- Sep 5, 2026Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2026-19769 · affects up to 3.15.1 · reported by WordfenceHigh 7.2
- Sep 4, 2026Ninja Forms: Does not restrict its REST abilities to administratorsCVE-2026-80438 · fixed in 3.15.2 · reported by WPScanMedium 5.9
- Aug 6, 2026Ninja Forms: Does not prevent user-supplied query-string inputCVE-2026-15256 · fixed in 3.14.10 · reported by WPScanMedium 4.8
- Jul 24, 2026Ninja Forms – The Contact Form Builder That Grows With You: Generic SQL InjectionCVE-2026-15663 · affects up to 3.14.9 · reported by WordfenceMedium 4.9
- Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrCVE-2026-65052 · reported by VulnCheckHigh 8.7
- Jul 21, 2026Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to byCVE-2026-65051 · reported by VulnCheckMedium 6.9
- Jul 21, 2026the render callback of the `ninja-forms/submissions-table` Gutenberg block that: Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorizationCVE-2026-65050 · reported by VulnCheckHigh 7.1
- Jul 21, 2026Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to triCVE-2026-65049 · reported by VulnCheckHigh 8.4
- Jul 21, 2026Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable FieldsetCVE-2026-65048 · affects up to 3.14.9 · reported by VulnCheckCritical 9.3
- Jul 1, 2026Ninja Forms – The Contact Form Builder That Grows With You: Unauthorized access of dataCVE-2026-1239 · affects up to 3.14.1 · reported by WordfenceHigh 7.5
- Mar 28, 2026Ninja Forms - The Contact Form Builder That Grows With You: Sensitive Information ExposureCVE-2026-1307 · affects up to 3.14.1 · reported by WordfenceMedium 6.5
- Feb 10, 2026Ninja Forms: Sensitive Information ExposureCVE-2026-2268 · affects up to 3.14.0 · reported by WordfenceHigh 7.5
- Jan 2, 2026Ninja Forms: Allows unauthenticated attackers to generate valid access tokens via the REST APICVE-2025-14072 · fixed in 3.13.3 · reported by WPScanMedium 5.3
- Dec 17, 2025Ninja Forms – The Contact Form Builder That Grows With You: Insecure Direct Object ReferenceCVE-2025-11924 · affects up to 3.13.2 · reported by WordfenceHigh 7.5
- Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10499 · affects up to 3.12.0 · reported by WordfenceMedium 4.3
- Sep 26, 2025Ninja Forms – The Contact Form Builder That Grows With You: Cross-Site Request ForgeryCVE-2025-10498 · affects up to 3.12.0 · reported by WordfenceMedium 4.3
- Sep 18, 2025Ninja Forms: Unserializes user input via form fieldCVE-2025-9083 · fixed in 3.11.1 · reported by WPScanCritical 9.8
- Jun 27, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2025-5398 · affects up to 3.10.2.1 · reported by WordfenceMedium 6.4
- May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2561 · fixed in 3.10.1 · reported by WPScanMedium 4.8
- May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2560 · fixed in 3.10.1 · reported by WPScanMedium 4.8
- May 19, 2025Ninja Forms: Does not sanitise and escape some of its settingsCVE-2025-2524 · fixed in 3.10.1 · reported by WPScanMedium 4.8
- Jan 30, 2025Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-13470 · affects up to 3.8.24 · reported by WordfenceMedium 6.4
- Dec 29, 2024The Ninja Forms – The Contact Form Builder That Grows With You: Arbitrary shortcode executionCVE-2024-12238 · affects up to 3.8.22 · reported by WordfenceMedium 6.3
- Dec 12, 2024Ninja Forms – The Contact Form Builder That Grows With You: Stored Cross-Site ScriptingCVE-2024-11052 · affects up to 3.8.19 · reported by WordfenceHigh 7.2
- Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50515 · affects up to 3.8.16 · reported by PatchstackMedium 5.9
- Nov 19, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50514 · affects up to 3.8.16 · reported by PatchstackMedium 5.9
- Sep 25, 2024Ninja Forms Contact Form: Reflected Self-Based Cross-Site ScriptingCVE-2024-3866 · affects up to 3.8.15 · reported by WordfenceMedium 4.7
- Sep 17, 2024Ninja Forms: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43999 · affects up to 3.8.11 · reported by PatchstackMedium 5.9
- Sep 2, 2024Ninja Forms: Does not escape an URL before outputting it back in an attributeCVE-2024-7354 · fixed in 3.8.11 · reported by WPScanMedium 6.1
- Aug 26, 2024Ninja Forms: Cross-Site Request Forgery (CSRF)CVE-2024-39628 · affects up to 3.8.6 · reported by PatchstackMedium 5.4
- Jul 9, 2024Ninja Forms: Improper Control of Generation of Code ('Code Injection')CVE-2024-37934 · affects up to 3.8.4 · reported by PatchstackMedium 5.4
- Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38393 · affects up to 3.6.25 · reported by PatchstackHigh 7.6
- Jun 19, 2024Ninja Forms: Missing AuthorizationCVE-2023-38386 · affects up to 3.6.25 · reported by PatchstackHigh 7.6
- Apr 17, 2024Ninja Forms Contact Form: Improper Input ValidationCVE-2023-36505 · affects up to 3.6.24 · reported by PatchstackMedium 6.8
- Apr 10, 2024custom fields for labels: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-29220 · fixed in 3.8.1 · reported by vultures@jpcert.or.jpMedium 6.1
- Apr 10, 2024submit processing: Ninja Forms prior to 3.8.1 contains a cross-site scriptingCVE-2024-26019 · fixed in 3.8.1 · reported by vultures@jpcert.or.jpMedium 5.4
- Apr 10, 2024Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31.CVE-2024-25572 · fixed in 3.4.31 · reported by vultures@jpcert.or.jpHigh 8.8
- Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Cross-Site Request ForgeryCVE-2024-2113 · affects up to 3.8.0 · reported by WordfenceMedium 4.3
- Mar 29, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Stored Cross-Site ScriptingCVE-2024-2108 · affects up to 3.8.0 · reported by WordfenceMedium 4.6
- Feb 2, 2024Ninja Forms Contact Form – The Drag and Drop Form Builder for: Second Order SQL InjectionCVE-2024-0685 · affects up to 3.7.1 · reported by WordfenceMedium 5.9
- Dec 7, 2023Ninja Forms Contact Form – The Drag and Drop Form Builder for: Uncontrolled Resource ConsumptionCVE-2023-35909 · affects up to 3.6.25 · reported by PatchstackMedium 5.3
- Nov 6, 2023Ninja Forms Contact Form: Does not sanitize and escape its label fieldsCVE-2023-5530 · fixed in 3.6.34 · reported by WPScanMedium 4.8
- Jul 27, 2023Unauth.CVE-2023-37979 · fixed in 3.6.26 · reported by Patchstack9.7% oddsHigh 7.1
- May 15, 2023Ninja Forms Contact Form: Does not properly escape user input before outputting it back in an admin pageCVE-2023-1835 · fixed in 3.6.22 · reported by WPScanMedium 6.1
- Sep 26, 2022Ninja Forms Contact Form: Unserialises the content of an imported fileCVE-2022-2903 · fixed in 3.6.13 · reported by WPScan1.4% oddsHigh 7.2
- Jul 4, 2022Ninja Forms Contact Form: Does not sanitize and escape some imported dataCVE-2021-25066 · fixed in 3.6.10 · reported by WPScanMedium 4.8
- Jul 4, 2022Ninja Forms Contact Form: Does not sanitise and escape field labelsCVE-2021-25056 · fixed in 3.6.10 · reported by WPScanMedium 4.8
- Jun 16, 2022Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at: Auth. (admin+) Stored Cross-Site Scripting (XSS)CVE-2021-36827 · affects up to 3.6.9 · reported by PatchstackMedium 4.8
- Nov 29, 2021Ninja Forms Contact Form: Does not escape keys of the fields POST parameterCVE-2021-24889 · fixed in 3.6.4 · reported by WPScan1.3% oddsHigh 7.2
- Oct 25, 2021Ninja Forms Contact Form: Does not sanitise and escape the custom class name of the form field createdCVE-2021-24381 · fixed in 3.5.8.2 · reported by WPScanMedium 4.8
- Sep 22, 2021Ninja Forms: Arbitrary email sendingCVE-2021-34648 · affects up to 3.5.7 · reported by WordfenceMedium 6.4
- Sep 22, 2021Ninja Forms: Sensitive information disclosureCVE-2021-34647 · affects up to 3.5.7 · reported by Wordfence1.2% oddsMedium 6.5
- Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a useCVE-2021-24165 · fixed in 3.4.34 · reported by WPScan1.6% oddsMedium 6.1
- Apr 5, 2021In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and rCVE-2021-24164 · fixed in 3.4.34.1 · reported by WPScanMedium 4.3
- Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.CVE-2020-36175 · fixed in 3.4.27.1 · reported by MITRE1.2% oddsMedium 5.3
- Jan 6, 2021The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration.CVE-2020-36174 · fixed in 3.4.27.1 · reported by MITREMedium 6.5
- Jan 6, 2021The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields.CVE-2020-36173 · fixed in 3.4.28 · reported by MITRE1.1% oddsMedium 5.3
- Apr 29, 2020The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.CVE-2020-12462 · fixed in 3.4.24.2 · reported by MITREMedium 6.1
- Feb 14, 2020The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninjCVE-2020-8594 · affects 3.4.22 to 3.4.22 · reported by MITRE1.2% oddsMedium 5.4
- Aug 22, 2019The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests.CVE-2018-20981 · fixed in 3.3.9 · reported by MITRE1.7% oddsCritical 9.1
- Aug 22, 2019The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering.CVE-2018-20980 · fixed in 3.2.15 · reported by MITRE1.4% oddsHigh 7.5
- Aug 22, 2019The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder.CVE-2017-18574 · fixed in 3.0.31 · reported by MITREMedium 6.1
- Aug 14, 2019The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page.CVE-2019-15025 · fixed in 3.3.21.2 · reported by MITRE1.8% oddsCritical 9.8
- Dec 3, 2018An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.pCVE-2018-19796 · fixed in 3.3.19.1 · reported by MITRE1.6% oddsMedium 6.1
- Nov 15, 2018XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submisCVE-2018-19287 · fixed in 3.3.18 · reported by MITRE8.9% oddsMedium 6.1
- Sep 1, 2018The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection.CVE-2018-16308 · fixed in 3.3.14.1 · reported by MITRE1.8% oddsHigh 8.6
- Feb 21, 2018The Ninja Forms plugin before 3.2.14 for WordPress has XSS.CVE-2018-7280 · fixed in 3.2.14 · reported by MITREMedium 6.1
- May 14, 2016The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST reqCVE-2016-1209 · fixed in 2.9.42.1 · reported by vultures@jpcert.or.jp62% oddsCritical 9.8
- Mar 5, 2015Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web scriCVE-2015-2220 · fixed in 2.8.9 · reported by MITRE2.0% oddsMedium 4.3
- Mar 5, 2015Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.CVE-2014-9688 · fixed in 2.8.10 · reported by MITRE2.0% oddsHigh 7.5
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.