PLUGIN SECURITY
Is Ninja Forms safe?
Free WordPress form builder with calculations, signatures, star ratings, unlimited submissions stored on your site, and an AI form builder.
What this plugin does
- Slug:
ninja-forms - Author: Kevin Stover
- 500000+ active installs
- 88/100 rating (1397 reviews on wordpress.org)
- 64147214 all-time downloads
- On WordPress.org since 2011-12-21
Calculator formcontact formform builderformslead form
Maintenance status
- Last updated: 2026-10-15 6:39pm GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
83 known CVEs on file for Ninja Forms.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-110899 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.6 | — | High 7.1 | < 3.15.6 | 3.15.6 | 2026-10-01 | — |
| CVE-2026-102385 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.15.5 | 3.15.5 | 2026-09-30 | — |
| CVE-2026-90438 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 3.15.5 | 3.15.5 | 2026-09-23 | — |
| CVE-2026-92438 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 8.8 | < 3.15.4 | 3.15.4 | 2026-09-22 | — |
| CVE-2026-91827 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.4 | Deserialization of Untrusted Data | High 7.5 | < 3.15.4 | 3.15.4 | 2026-09-22 | — |
| CVE-2026-95515 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.15.4 | 3.15.4 | 2026-09-22 | — |
| CVE-2026-94504 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 3.15.4 | 3.15.4 | 2026-09-08 | — |
| CVE-2026-80437 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.2 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 4.8 | < 3.15.2 | 3.15.2 | 2026-09-06 | — |
+ 134 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-80438 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.2 | Improper Access Control | Unknown | < 3.15.2 | 3.15.2 | 2026-09-04 | — |
| CVE-2026-11363 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.7 | Deserialization of Untrusted Data | Medium 6.6 | < 3.14.7 | 3.14.7 | 2026-09-04 | — |
| CVE-2026-15256 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.10 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 4.8 | < 3.14.10 | 3.14.10 | 2026-08-06 | — |
| CVE-2026-19769 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.15.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 3.15.2 | 3.15.2 | 2026-07-23 | — |
| CVE-2026-65052 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.14.8 (unfixed) | — | High 7.5 | < 3.14.8 | 3.14.8 | 2026-07-21 | — |
| CVE-2026-65051 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.14.8 (unfixed) | — | Medium 6.5 | < 3.14.8 | 3.14.8 | 2026-07-21 | — |
| CVE-2026-65050 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.14.8 (unfixed) | — | Medium 6.5 | < 3.14.8 | 3.14.8 | 2026-07-21 | — |
| CVE-2026-65049 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.14.8 (unfixed) | — | Critical 9.3 | < 3.14.8 | 3.14.8 | 2026-07-21 | — |
| CVE-2026-65048 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.10.4 (unfixed) | — | Critical 9.3 | < 3.10.4 | 3.10.4 | 2026-07-21 | — |
| CVE-2026-1239 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.2 | Missing Authorization | High 7.5 | < 3.14.2 | 3.14.2 | 2026-06-30 | — |
| CVE-2025-11924 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.13.3 | Authorization Bypass Through User-Controlled Key | High 7.5 | < 3.13.3 | 3.13.3 | 2025-12-16 | — |
| CVE-2025-14072 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.13.3 | Improper Authentication | Medium 5.3 | < 3.13.3 | 3.13.3 | 2025-12-12 | — |
| CVE-2025-10498 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.12.1 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 3.12.1 | 3.12.1 | 2025-09-26 | — |
| CVE-2025-10499 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.12.1 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 3.12.1 | 3.12.1 | 2025-09-26 | — |
| CVE-2024-13470 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 3.8.25 | 3.8.25 | 2025-01-29 | — |
| CVE-2024-12238 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.23 | Improper Control of Generation of Code ('Code Injection') | Medium 6.3 | < 3.8.23 | 3.8.23 | 2024-12-28 | — |
| CVE-2024-11052 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 3.8.20 | 3.8.20 | 2024-12-11 | — |
| CVE-2024-50514 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 3.8.18 | 3.8.18 | 2024-10-28 | — |
| CVE-2024-50515 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.9 | < 3.8.18 | 3.8.18 | 2024-10-28 | — |
| CVE-2024-3866 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.8.16 | 3.8.16 | 2024-09-24 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] >= 3.8.6 - <= 3.8.10 | — | Unknown | 3.8.6–3.8.10 | 3.8.10 | 2024-09-03 | — |
| CVE-2024-43999 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.8.12 | 3.8.12 | 2024-08-28 | — |
| CVE-2024-7354 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.8.11 | 3.8.11 | 2024-08-12 | — |
| CVE-2024-39628 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.7 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 3.8.7 | 3.8.7 | 2024-07-24 | — |
| CVE-2024-37934 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.5 | Improper Control of Generation of Code ('Code Injection') | Critical 9.8 | < 3.8.5 | 3.8.5 | 2024-07-04 | — |
| CVE-2024-29220 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.8.1 | 3.8.1 | 2024-04-08 | — |
| CVE-2024-26019 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.8.1 | 3.8.1 | 2024-04-08 | — |
| CVE-2024-25572 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.1 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 3.8.1 | 3.8.1 | 2024-04-08 | — |
| CVE-2024-2108 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.8.1 | 3.8.1 | 2024-03-28 | — |
| CVE-2024-2113 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.3 | < 3.8.1 | 3.8.1 | 2024-03-28 | — |
| CVE-2024-0685 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.7.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 3.7.2 | 3.7.2 | 2024-02-01 | — |
| CVE-2023-5530 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.34 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.6.34 | 3.6.34 | 2023-10-16 | — |
| CVE-2023-4109 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.26 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 4.8 | < 3.6.26 | 3.6.26 | 2023-08-07 | — |
| CVE-2023-37979 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 3.6.26 | 3.6.26 | 2023-07-25 | — |
| CVE-2023-38386 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.26 | Missing Authorization | High 7.6 | < 3.6.26 | 3.6.26 | 2023-07-25 | — |
| CVE-2023-38393 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.26 | Missing Authorization | High 7.6 | < 3.6.26 | 3.6.26 | 2023-07-25 | — |
| CVE-2023-35909 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.26 | Uncontrolled Resource Consumption | Medium 5.3 | < 3.6.26 | 3.6.26 | 2023-07-07 | — |
| CVE-2023-36505 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.25 | Improper Input Validation | Medium 6.8 | < 3.6.25 | 3.6.25 | 2023-06-22 | — |
| CVE-2023-1835 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.6.22 | 3.6.22 | 2023-04-24 | — |
| CVE-2022-2903 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.13 | Deserialization of Untrusted Data | High 7.2 | < 3.6.13 | 3.6.13 | 2022-09-05 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] <= 3.6.10 | — | Unknown | < 3.6.10 | 3.6.10 | 2022-06-15 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.11 | — | Unknown | < 3.6.11 | 3.6.11 | 2022-06-15 | — |
| CVE-2021-25056 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.6.10 | 3.6.10 | 2022-06-13 | — |
| CVE-2021-25066 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.6.11 | 3.6.11 | 2022-06-10 | — |
| CVE-2021-36827 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.6.10 | 3.6.10 | 2022-06-07 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.10 | — | Unknown | < 3.6.10 | 3.6.10 | 2022-06-07 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.8 | — | Unknown | < 3.6.8 | 3.6.8 | 2022-03-22 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.8 | — | Unknown | < 3.6.8 | 3.6.8 | 2022-03-22 | — |
| CVE-2021-24889 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.4 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 3.6.4 | 3.6.4 | 2021-10-26 | — |
| CVE-2021-24381 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.6.8 | 3.6.8 | 2021-09-27 | — |
| CVE-2021-34647 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.5.8 | Missing Authorization | Medium 6.5 | < 3.5.8 | 3.5.8 | 2021-09-22 | — |
| CVE-2021-34648 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.5.8 | Missing Authorization | Medium 4.3 | < 3.5.8 | 3.5.8 | 2021-09-22 | — |
| CVE-2021-24165 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 6.1 | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| CVE-2021-24163 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | Exposure of Sensitive Information to an Unauthorized Actor | High 8.8 | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| CVE-2021-24164 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 3.4.34.1 | 3.4.34.1 | 2021-02-16 | — |
| CVE-2021-24166 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | Cross-Site Request Forgery (CSRF) | Medium 5.4 | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | — | Unknown | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | — | Unknown | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | — | Unknown | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.34 | — | Unknown | < 3.4.34 | 3.4.34 | 2021-02-16 | — |
| CVE-2020-36174 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.27.1 | Cross-Site Request Forgery (CSRF) | Medium 6.5 | < 3.4.27.1 | 3.4.27.1 | 2020-09-22 | — |
| CVE-2020-36175 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.27.1 | Improper Input Validation | Medium 5.3 | < 3.4.27.1 | 3.4.27.1 | 2020-09-22 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.27.1 | — | Unknown | < 3.4.27.1 | 3.4.27.1 | 2020-09-22 | — |
| CVE-2020-36173 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.28 | Improper Encoding or Escaping of Output | Medium 5.3 | < 3.4.28 | 3.4.28 | 2020-09-20 | — |
| CVE-2020-12462 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.24.2 | Cross-Site Request Forgery (CSRF) | Medium 6.1 | < 3.4.24.2 | 3.4.24.2 | 2020-04-28 | — |
| CVE-2020-8594 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.4.23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.4.23 | 3.4.23 | 2020-02-03 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.21.3 | — | Unknown | < 3.3.21.3 | 3.3.21.3 | 2019-06-25 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.21.3 | — | Unknown | < 3.3.21.3 | 3.3.21.3 | 2019-06-25 | — |
| CVE-2019-15025 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.21.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Critical 9.8 | < 3.3.21.2 | 3.3.21.2 | 2019-01-07 | — |
| CVE-2018-19796 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.19.1 | URL Redirection to Untrusted Site ('Open Redirect') | Medium 6.1 | < 3.3.19.1 | 3.3.19.1 | 2018-12-01 | — |
| CVE-2018-19287 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.3.18 | 3.3.18 | 2018-11-15 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.14 | — | Unknown | < 3.3.14 | 3.3.14 | 2018-08-28 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.14 | — | Unknown | < 3.3.14 | 3.3.14 | 2018-08-28 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.14 | — | Unknown | < 3.3.14 | 3.3.14 | 2018-08-27 | — |
| CVE-2018-16308 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.14 | Improper Neutralization of Formula Elements in a CSV File | High 8.6 | < 3.3.14 | 3.3.14 | 2018-08-19 | — |
| CVE-2018-20981 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.9 | Improper Input Validation | Critical 9.1 | < 3.3.9 | 3.3.9 | 2018-07-06 | — |
| CVE-2018-20980 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.2.15 | Improper Input Validation | High 7.5 | < 3.2.15 | 3.2.15 | 2018-02-26 | — |
| CVE-2018-7280 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.2.14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.2.14 | 3.2.14 | 2018-02-20 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.0.32 | — | Unknown | < 3.0.32 | 3.0.32 | 2017-04-17 | — |
| CVE-2017-18574 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.0.31 | Improper Input Validation | Medium 6.1 | < 3.0.31 | 3.0.31 | 2017-03-07 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.55.2 | — | Unknown | < 2.9.55.2 | 2.9.55.2 | 2016-08-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.55.2 | — | Unknown | < 2.9.55.2 | 2.9.55.2 | 2016-08-16 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.52 | — | Unknown | < 2.9.52 | 2.9.52 | 2016-07-19 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.52 | — | Unknown | < 2.9.52 | 2.9.52 | 2016-07-19 | — |
| CVE-2016-1209 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] >= 2.9.36 - <= 2.9.42 | Improper Input Validation | Critical 9.8 | 2.9.36–2.9.43 | 2.9.43 | 2015-12-26 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.29 | — | Unknown | < 2.9.29 | 2.9.29 | 2015-12-08 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.28 | — | Unknown | < 2.9.28 | 2.9.28 | 2015-09-30 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.28 | — | Unknown | < 2.9.28 | 2.9.28 | 2015-09-30 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.22 | — | Unknown | < 2.9.22 | 2.9.22 | 2015-08-04 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.22 | — | Unknown | < 2.9.22 | 2.9.22 | 2015-08-04 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.19 | — | Unknown | < 2.9.19 | 2.9.19 | 2015-06-05 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.19 | — | Unknown | < 2.9.19 | 2.9.19 | 2015-06-05 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.11 | — | Unknown | < 2.9.11 | 2.9.11 | 2015-04-20 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.11 | — | Unknown | < 2.9.11 | 2.9.11 | 2015-04-20 | — |
| CVE-2014-9688 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.8.10 | — | Unknown | < 2.8.10 | 2.8.10 | 2014-12-02 | — |
| CVE-2015-2220 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.8.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.8.9 | 2.8.9 | 2014-11-20 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.7.8 | — | Unknown | < 2.7.8 | 2.7.8 | 2014-09-08 | — |
| CVE-2014-8815 | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.8.7 | — | Unknown | < 2.8.7 | 2.8.7 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.10.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 3.10.1 | 3.10.1 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.10.2.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 3.10.2.2 | 3.10.2.2 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.2 | — | Unknown | < 3.14.2 | 3.14.2 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.1 | — | Unknown | < 3.14.1 | 3.14.1 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.11.1 | — | Critical 9.8 | < 3.11.1 | 3.11.1 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.14.10 | — | Unknown | < 3.14.10 | 3.14.10 | 0000-00-00 | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.11 | — | Unknown | < 3.6.11 | 3.6.11 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.6.8 | — | Unknown | < 3.6.8 | 3.6.8 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.5.5 | — | Unknown | < 3.5.5 | 3.5.5 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.21.3 | — | Unknown | < 3.3.21.3 | 3.3.21.3 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 3.3.14 | — | Unknown | < 3.3.14 | 3.3.14 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.55.2 | — | Unknown | < 2.9.55.2 | 2.9.55.2 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.52 | — | Unknown | < 2.9.52 | 2.9.52 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.28 | — | Unknown | < 2.9.28 | 2.9.28 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.22 | — | Unknown | < 2.9.22 | 2.9.22 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.19 | — | Unknown | < 2.9.19 | 2.9.19 | — | — |
| — | Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder [ninja-forms] < 2.9.11 | — | Unknown | < 2.9.11 | 2.9.11 | — | — |
| — | Ninja Forms <= 2.9.10 - Cross-Site Scripting (XSS) | — | Unknown | < 2.9.11 | 2.9.11 | — | — |
| — | Ninja Forms <= 2.9.18 - Cross-Site Scripting (XSS) | — | Unknown | < 2.9.19 | 2.9.19 | — | — |
| — | Ninja Forms <= 2.9.21 - Authenticated Reflected Cross-Site Scripting (XSS) | — | Unknown | < 2.9.22 | 2.9.22 | — | — |
| — | Ninja Forms <= 2.9.27 - Malicious File Export | — | Unknown | < 2.9.28 | 2.9.28 | — | — |
| — | Ninja Forms <= 2.9.51 - Multiple Authenticated Cross-Site Scripting (XSS) | — | Unknown | < 2.9.52 | 2.9.52 | — | — |
| — | Ninja Forms <= 2.9.55.1 - Authenticated SQL Injection | — | Unknown | < 2.9.55.2 | 2.9.55.2 | — | — |
| — | Ninja Forms <= 3.3.13 - Cross-Site Scripting (XSS) in Import Function | — | Unknown | < 3.3.14 | 3.3.14 | — | — |
| — | Ninja Forms < 3.3.21.3 - XSS and SQLi | — | Unknown | < 3.3.21.3 | 3.3.21.3 | — | — |
| — | Ninja Forms < 3.6.8-wp - Unauthenticated Email Address Disclosure | — | Unknown | < 3.6.8-wp | 3.6.8-wp | — | — |
| — | Nina Forms < 3.5.5 - Reflected Cross-Site Scripting | — | Unknown | < 3.5.5 | 3.5.5 | — | — |
| — | Ninja Forms < 3.6.11 - Unauthenticated PHP Object Injection | — | Unknown | < 3.6.11 | 3.6.11 | — | — |
| CVE-2025-2561 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | — | Unknown | < 3.10.1 | 3.10.1 | — | — |
| CVE-2025-2524 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | — | Unknown | < 3.10.1 | 3.10.1 | — | — |
| CVE-2025-2560 | Ninja Forms < 3.10.1 - Admin+ Stored XSS | — | Unknown | < 3.10.1 | 3.10.1 | — | — |
| CVE-2025-5398 | Ninja Forms < 3.10.2.2 - Contributor+ Stored XSS via CSTI | — | Unknown | < 3.10.2.2 | 3.10.2.2 | — | — |
| CVE-2025-9083 | Ninja-forms < 3.11.1 - Unauthenticated PHP Object Injection | — | Unknown | < 3.11.1 | 3.11.1 | — | — |
| CVE-2026-2268 | Ninja Forms < 3.14.1 - Unauthenticated Information Disclosure | — | Unknown | < 3.14.1 | 3.14.1 | — | — |
| CVE-2026-1307 | Ninja Forms < 3.14.2 - Contributor+ Sensitive Information Disclosure via Block Editor Token | — | Unknown | < 3.14.2 | 3.14.2 | — | — |
| CVE-2026-15663 | Ninja Forms < 3.14.10 - Admin+ SQL Injection via Import File settings Key | — | Unknown | < 3.14.10 | 3.14.10 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — 80/100 (2184) — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1187) — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14385)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 800000+ active installs — 96/100 (806) — max PHP <8.0
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ active installs — 96/100 (2138)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.