Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities

Known security issues in the Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: ninja-forms
Latest version: 3.15.6
Active installs: 500,000+
Known vulnerabilities: 124 (5 without a fix)
Data updated: 2026-10-17 08:35 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

No fix available (5)

The source lists no fixed version. Consider deactivating and replacing the plugin until a fix is released.

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: No fix available
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-sco CVE-2026-65049 · Source	Critical	9.3	<= 3.14.8	2026-07-21
[en] Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex() accepts arbitrary strings as submissi CVE-2026-65048 · Source	Critical	9.3	<= 3.10.4	2026-07-21
[en] Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting CVE-2026-65052 · Source	High	7.5	<= 3.14.8	2026-07-21
[en] Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over CVE-2026-65051 · Source	Medium	6.5	<= 3.14.8	2026-07-21
[en] Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level pr CVE-2026-65050 · Source	Medium	6.5	<= 3.14.8	2026-07-21

Fixed in version 3.15.5 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.15.5
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission CVE-2026-90438 · Source	High	7.2	< 3.15.5	2026-09-23
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting CVE-2026-102385 · Source	High	7.1	< 3.15.5	2026-09-30

Fixed in version 3.15.4 (4)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.15.4
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting CVE-2026-92438 · Source	High	8.8	< 3.15.4	2026-09-22
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection CVE-2026-91827 · Source	High	7.5	< 3.15.4	2026-09-22
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting CVE-2026-94504 · Source	High	7.2	< 3.15.4	2026-09-08
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting CVE-2026-95515 · Source	High	7.1	< 3.15.4	2026-09-22

Fixed in version 3.15.2 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.15.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key CVE-2026-19769 · Source	High	7.2	< 3.15.2	2026-07-23
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution CVE-2026-80437 · Source	Medium	4.8	< 3.15.2	2026-09-06
Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure CVE-2026-80438 · Source	Not rated	-	< 3.15.2	2026-09-04

Fixed in version 3.14.10 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.14.10
Vulnerability	Severity	CVSS	Affected versions	Published
[en] The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute ar CVE-2026-15256 · Source	Medium	4.8	< 3.14.10	2026-08-06
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key CVE-2026-15663 · Source	Not rated	-	< 3.14.10	0000-00-00

Fixed in version 3.14.7 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.14.7
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import CVE-2026-11363 · Source	Medium	6.6	< 3.14.7	2026-09-04

Fixed in version 3.14.2 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.14.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint CVE-2026-1239 · Source	High	7.5	< 3.14.2	2026-06-30
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token CVE-2026-1307 · Source	Not rated	-	< 3.14.2	0000-00-00

Fixed in version 3.14.1 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.14.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action CVE-2026-2268 · Source	Not rated	-	< 3.14.1	0000-00-00

Fixed in version 3.13.3 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.13.3
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token CVE-2025-11924 · Source	High	7.5	< 3.13.3	2025-12-16
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure CVE-2025-14072 · Source	Medium	5.3	< 3.13.3	2025-12-12

Fixed in version 3.12.1 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.12.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion CVE-2025-10498 · Source	Medium	5.4	< 3.12.1	2025-09-26
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update CVE-2025-10499 · Source	Medium	4.3	< 3.12.1	2025-09-26

Fixed in version 3.11.1 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.11.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja-forms < 3.11.1 - Unauthenticated PHP Objection CVE-2025-9083 · Source	Not rated	-	< 3.11.1	0000-00-00

Fixed in version 3.10.2.2 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.10.2.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI CVE-2025-5398 · Source	Medium	5.4	< 3.10.2.2	0000-00-00

Fixed in version 3.10.1 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.10.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms < 3.10.1 - Admin+ Stored XSS CVE-2025-2561 · Source	Medium	4.8	< 3.10.1	0000-00-00
Ninja Forms < 3.10.1 - Admin+ Stored XSS CVE-2025-2560 · Source	Medium	4.8	< 3.10.1	0000-00-00
Ninja Forms < 3.10.1 - Admin+ Stored XSS CVE-2025-2524 · Source	Medium	4.8	< 3.10.1	0000-00-00

Fixed in version 3.8.25 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.25
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2024-13470 · Source	Medium	6.4	< 3.8.25	2025-01-29

Fixed in version 3.8.23 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.23
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution CVE-2024-12238 · Source	Medium	6.3	< 3.8.23	2024-12-28

Fixed in version 3.8.20 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.20
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations CVE-2024-11052 · Source	High	7.2	< 3.8.20	2024-12-11

Fixed in version 3.8.18 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.18
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.8.16 is vulnerable to Cross Site Scripting (XSS) CVE-2024-50514 · Source	Medium	5.9	< 3.8.18	2024-10-28
WordPress Ninja Forms Plugin <= 3.8.16 is vulnerable to Cross Site Scripting (XSS) CVE-2024-50515 · Source	Medium	5.9	< 3.8.18	2024-10-28

Fixed in version 3.8.16 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.16
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.8.15 is vulnerable to Cross Site Scripting (XSS) CVE-2024-3866 · Source	Medium	6.1	< 3.8.16	2024-09-24

Fixed in version 3.8.12 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.12
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.8.11 is vulnerable to Cross Site Scripting (XSS) CVE-2024-43999 · Source	Medium	4.8	< 3.8.12	2024-08-28

Fixed in version 3.8.11 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.11
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting CVE-2024-7354 · Source	Medium	6.1	< 3.8.11	2024-08-12

Fixed in version 3.8.7 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.7
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.8.6 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2024-39628 · Source	High	8.8	< 3.8.7	2024-07-24

Fixed in version 3.8.5 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.5
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.8.4 is vulnerable to Broken Access Control CVE-2024-37934 · Source	Critical	9.8	< 3.8.5	2024-07-04

Fixed in version 3.8.1 (5)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.8.1
Vulnerability	Severity	CVSS	Affected versions	Published
Multiple vulnerabilities in WordPress Plugin "Ninja Forms" CVE-2024-25572 · Source	High	8.8	< 3.8.1	2024-04-08
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-29220 · Source	Medium	6.1	< 3.8.1	2024-04-08
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2024-26019 · Source	Medium	5.4	< 3.8.1	2024-04-08
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-2108 · Source	Medium	5.4	< 3.8.1	2024-03-28
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export CVE-2024-2113 · Source	Medium	4.3	< 3.8.1	2024-03-28

Fixed in version 3.7.2 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.7.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection CVE-2024-0685 · Source	Critical	9.8	< 3.7.2	2024-02-01

Fixed in version 3.6.34 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.34
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-5530 · Source	Medium	4.8	< 3.6.34	2023-10-16

Fixed in version 3.6.26 (5)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.26
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export CVE-2023-38386 · Source	High	7.6	< 3.6.26	2023-07-25
Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export CVE-2023-38393 · Source	High	7.6	< 3.6.26	2023-07-25
Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data' CVE-2023-37979 · Source	High	7.1	< 3.6.26	2023-07-25
WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Denial of Service Attack CVE-2023-35909 · Source	Medium	5.3	< 3.6.26	2023-07-07
Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection CVE-2023-4109 · Source	Medium	4.8	< 3.6.26	2023-08-07

Fixed in version 3.6.25 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.25
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion CVE-2023-36505 · Source	Medium	6.8	< 3.6.25	2023-06-22

Fixed in version 3.6.22 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.22
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin < 3.6.22 is vulnerable to Cross Site Scripting (XSS) CVE-2023-1835 · Source	Medium	6.1	< 3.6.22	2023-04-24

Fixed in version 3.6.13 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.13
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress NinjaForms plugin <= 3.6.12 - Authenticated PHP Objection Injection vulnerability CVE-2022-2903 · Source	High	7.2	< 3.6.13	2022-09-05

Fixed in version 3.6.11 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.11
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-25066 · Source	Medium	4.8	< 3.6.11	2022-06-10
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection No CVE assigned · Source	Not rated	-	< 3.6.11	2022-06-15
Ninja Forms < 3.6.11 - Unauthenticated PHP Object Injection No CVE assigned · Source	Not rated	-	< 3.6.11	-

Fixed in version 3.6.10 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.10
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-25056 · Source	Medium	4.8	< 3.6.10	2022-06-13
WordPress Ninja Forms Contact Form plugin <= 3.6.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-36827 · Source	Medium	4.8	< 3.6.10	2022-06-07
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection No CVE assigned · Source	Not rated	-	< 3.6.10	2022-06-07

Fixed in version 3.6.8 (4)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Contact Form plugin <= 3.5.8.1 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24381 · Source	Medium	4.8	< 3.6.8	2021-09-27
WordPress Ninja Forms plugin <= 3.6.7 - Unauthenticated Email Address Disclosure vulnerability No CVE assigned · Source	Not rated	-	< 3.6.8	2022-03-22
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure No CVE assigned · Source	Not rated	-	< 3.6.8	2022-03-22
Ninja Forms < 3.6.8 - Unauthenticated Email Address Disclosure No CVE assigned · Source	Not rated	-	< 3.6.8	-

Fixed in version 3.6.4 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.6.4
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Contact Form plugin <= 3.6.3 - SQL Injection (SQLi) vulnerability CVE-2021-24889 · Source	High	7.2	< 3.6.4	2021-10-26

Fixed in version 3.5.8 (2)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.5.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Contact Form plugin <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure vulnerability CVE-2021-34647 · Source	Medium	6.5	< 3.5.8	2021-09-22
WordPress Ninja Forms Contact Form plugin <= 3.5.7 - Unprotected REST-API to Email Injection vulnerability CVE-2021-34648 · Source	Medium	4.3	< 3.5.8	2021-09-22

Fixed in version 3.5.5 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.5.5
Vulnerability	Severity	CVSS	Affected versions	Published
Nina Forms < 3.5.5 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.5.5	-

Fixed in version 3.4.34.1 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.34.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure CVE-2021-24164 · Source	Medium	4.3	< 3.4.34.1	2021-02-16

Fixed in version 3.4.34 (7)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.34
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure CVE-2021-24163 · Source	High	8.8	< 3.4.34	2021-02-16
Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect CVE-2021-24165 · Source	Medium	6.1	< 3.4.34	2021-02-16
Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection CVE-2021-24166 · Source	Medium	5.4	< 3.4.34	2021-02-16
WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 3.4.34	2021-02-16
WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Administrator Open Redirect vulnerability No CVE assigned · Source	Not rated	-	< 3.4.34	2021-02-16
WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Authenticated OAuth Connection Key Disclosure vulnerability No CVE assigned · Source	Not rated	-	< 3.4.34	2021-02-16
WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure vulnerability No CVE assigned · Source	Not rated	-	< 3.4.34	2021-02-16

Fixed in version 3.4.28 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.28
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting CVE-2020-36173 · Source	Medium	5.3	< 3.4.28	2020-09-20

Fixed in version 3.4.27.1 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.27.1
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation CVE-2020-36174 · Source	Medium	6.5	< 3.4.27.1	2020-09-22
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field CVE-2020-36175 · Source	Medium	5.3	< 3.4.27.1	2020-09-22
WordPress Ninja Forms plugin <= 3.4.27 - Cross-Site Request Forgery (CSRF) leading to Arbitrary Plugin Installation vulnerability No CVE assigned · Source	Not rated	-	< 3.4.27.1	2020-09-22

Fixed in version 3.4.24.2 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.24.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting CVE-2020-12462 · Source	Medium	6.1	< 3.4.24.2	2020-04-28

Fixed in version 3.4.23 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.4.23
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting CVE-2020-8594 · Source	Medium	5.4	< 3.4.23	2020-02-03

Fixed in version 3.3.21.3 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.21.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.3.21 - Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.3.21.3	2019-06-25
WordPress Ninja Forms plugin <= 3.3.21 - SQL injection (SQLi) vulnerability No CVE assigned · Source	Not rated	-	< 3.3.21.3	2019-06-25
Ninja Forms <= 3.3.21 - XSS and SQLi No CVE assigned · Source	Not rated	-	< 3.3.21.3	-

Fixed in version 3.3.21.2 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.21.2
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection CVE-2019-15025 · Source	Critical	9.8	< 3.3.21.2	2019-01-07

Fixed in version 3.3.19.1 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.19.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.3.19 - Authenticated Open Redirect vulnerability CVE-2018-19796 · Source	Medium	6.1	< 3.3.19.1	2018-12-01

Fixed in version 3.3.18 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.18
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.3.17 - Unauthenticated Cross-Site Scripting (XSS) vulnerability CVE-2018-19287 · Source	Medium	6.1	< 3.3.18	2018-11-15

Fixed in version 3.3.14 (5)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.14
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.3.13 - CSV Injection CVE-2018-16308 · Source	High	8.6	< 3.3.14	2018-08-19
WordPress Ninja Forms plugin <= 3.3.13 - CSV Injection vulnerability No CVE assigned · Source	Not rated	-	< 3.3.14	2018-08-28
WordPress Ninja Forms plugin <= 3.3.13 - Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 3.3.14	2018-08-28
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 3.3.14	2018-08-27
Ninja Forms <= 3.3.13 - Cross-Site Scripting (XSS) in Import Function No CVE assigned · Source	Not rated	-	< 3.3.14	-

Fixed in version 3.3.9 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.3.9
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests CVE-2018-20981 · Source	Critical	9.1	< 3.3.9	2018-07-06

Fixed in version 3.2.15 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.2.15
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering CVE-2018-20980 · Source	High	7.5	< 3.2.15	2018-02-26

Fixed in version 3.2.14 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.2.14
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <=3.2.13 - Cross-Site Scripting (XSS) vulnerability CVE-2018-7280 · Source	Medium	6.1	< 3.2.14	2018-02-20

Fixed in version 3.0.32 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.0.32
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection No CVE assigned · Source	Not rated	-	< 3.0.32	2017-04-17

Fixed in version 3.0.31 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 3.0.31
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection CVE-2017-18574 · Source	Medium	6.1	< 3.0.31	2017-03-07

Fixed in version 2.9.55.2 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.55.2
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.55.1 - Authenticated SQL Injection No CVE assigned · Source	Not rated	-	< 2.9.55.2	2016-08-16
Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection No CVE assigned · Source	Not rated	-	< 2.9.55.2	2016-08-16
Ninja Forms <= 2.9.55.1 - Authenticated SQL Injection No CVE assigned · Source	Not rated	-	< 2.9.55.2	-

Fixed in version 2.9.52 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.52
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.51 - Multiple Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.52	2016-07-19
Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.52	2016-07-19
Ninja Forms <= 2.9.51 - Multiple Authenticated Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.9.52	-

Fixed in version 2.9.29 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.29
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.29	2015-12-08

Fixed in version 2.9.28 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.28
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.27 - Malicious File Export No CVE assigned · Source	Not rated	-	< 2.9.28	2015-09-30
Ninja Forms Contact Form <= 2.9.27 - CSV Injection No CVE assigned · Source	Not rated	-	< 2.9.28	2015-09-30
Ninja Forms <= 2.9.27 - Malicious File Export No CVE assigned · Source	Not rated	-	< 2.9.28	-

Fixed in version 2.9.22 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.22
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.21 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.22	2015-08-04
Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.22	2015-08-04
Ninja Forms <= 2.9.21 - Authenticated Reflected Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.9.22	-

Fixed in version 2.9.19 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.19
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.18 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.19	2015-06-05
Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.19	2015-06-05
Ninja Forms <= 2.9.18 - Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.9.19	-

Fixed in version 2.9.11 (3)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.9.11
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.9.10 - Cross Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.11	2015-04-20
Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting No CVE assigned · Source	Not rated	-	< 2.9.11	2015-04-20
Ninja Forms <= 2.9.10 - Cross-Site Scripting (XSS) No CVE assigned · Source	Not rated	-	< 2.9.11	-

Fixed in version 2.8.10 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.8.10
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.8.9 - Unspecified Vulnerability CVE-2014-9688 · Source	Low	0.0	< 2.8.10	2014-12-02

Fixed in version 2.8.9 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.8.9
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin <= 2.8.8 - Multiple XSS CVE-2015-2220 · Source	Low	0.0	< 2.8.9	2014-11-20

Fixed in version 2.8.7 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.8.7
Vulnerability	Severity	CVSS	Affected versions	Published
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting CVE-2014-8815 · Source	Not rated	-	< 2.8.7	0000-00-00

Fixed in version 2.7.8 (1)

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Fixed in version 2.7.8
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin - Authorization Bypass No CVE assigned · Source	Not rated	-	< 2.7.8	2014-09-08

Affects version 3.8.10 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Affects version 3.8.10 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms Plugin 3.8.6-3.8.10 is vulnerable to Cross Site Scripting (XSS) No CVE assigned · Source	Not rated	-	>= 3.8.6 and <= 3.8.10	2024-09-03

Affects version 3.6.10 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Affects version 3.6.10 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Ninja Forms plugin <= 3.6.10 - Unauthenticated PHP Object Injection vulnerability No CVE assigned · Source	Not rated	-	<= 3.6.10	2022-06-15

Affects version 2.9.42 and earlier (1)

The source does not state the fixed version; versions after this one are not listed as affected.

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: Affects version 2.9.42 and earlier
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress plugin "Ninja Forms" vulnerable to PHP object injection CVE-2016-1209 · Source	Critical	9.8	>= 2.9.36 and <= 2.9.42	2015-12-26

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.