VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder security & vulnerabilities

ninja-forms— active installsLast vulnerability Oct 30, 2026

No known unpatched vulnerabilities in the latest version

All 95 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
95Known vulnerabilities
  • Critical4
  • High28
  • Medium62
  • Low1
Vulnerabilities per year
2014: 3 vulnerabilities3142015: 5 vulnerabilities5152016: 4 vulnerabilities4162017: 2 vulnerabilities2172018: 7 vulnerabilities7182019: 1 vulnerability1192020: 5 vulnerabilities5202021: 8 vulnerabilities8212022: 7 vulnerabilities7222023: 8 vulnerabilities8232024: 14 vulnerabilities14242025: 10 vulnerabilities10252026: 21 vulnerabilities2126

All Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities
SeverityVulnerabilityCVEPublished
Medium6.1Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
≤3.15.5Update to 3.15.6
CVE-2026-100151
Medium6.5Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
≤3.15.5Update to 3.15.6
CVE-2026-100155
Medium5.4Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
≤3.15.5Update to 3.15.6
CVE-2026-101326
High7.2Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
≤3.15.5Update to 3.15.6
CVE-2026-109997
Medium5.8Unauthenticated CSV Injection
≤3.15.3Update to 3.15.4
CVE-2026-67187
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.5Update to 3.15.6
CVE-2026-110899
High7.2Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
≤3.15.4Update to 3.15.5
CVE-2026-90438
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.5
CVE-2026-102385
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-95515
High8.1Unauthenticated PHP Object Injection
≤3.15.3Update to 3.15.4
CVE-2026-91827
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-92438
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-94504
Medium6.6Authenticated (Administrator+) PHP Object Injection via Form Import
≤3.14.6Update to 3.14.7
CVE-2026-11363
High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
≤3.15.1Update to 3.15.2
CVE-2026-19769
Medium6.53.15.1 - Unauthenticated Arbitrary Shortcode Execution
3.14.10 – 3.15.1Update to 3.15.2
CVE-2026-80437
Low3.13.15.1 - Authenticated (Custom Role+) Information Exposure
3.14.0 – 3.15.1Update to 3.15.2
CVE-2026-80438
Medium5.3Unauthenticated Arbitrary Shortcode Execution
≤3.14.9Update to 3.14.10
CVE-2026-15256
Medium4.9Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
≤3.14.9Update to 3.14.10
CVE-2026-15663
High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
≤3.14.1Update to 3.14.2
CVE-2026-1239
Medium6.5Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
≤3.14.1Update to 3.14.2
CVE-2026-1307
High7.5Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
≤3.14.0Update to 3.14.1
CVE-2026-2268
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
≤3.13.2Update to 3.13.3
CVE-2025-11924
High7.5Missing Authorization to Unauthenticated Submission Disclosure
≤3.13.2Update to 3.13.3
CVE-2025-14072
Medium4.3Cross-Site Request Forgery to Plugin Settings Update
≤3.12.0Update to 3.12.1
CVE-2025-10499
Medium4.3Cross-Site Request Forgery to Limited File Deletion
≤3.12.0Update to 3.12.1
CVE-2025-10498
High8.1Unauthenticated PHP Object Injection
≤3.11.0Update to 3.11.1
CVE-2025-9083
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
≤3.10.2.1Update to 3.10.2.2
CVE-2025-5398
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.10.0Update to 3.10.1
CVE-2025-2524
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.10.0Update to 3.10.1
CVE-2025-2560
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.10.0Update to 3.10.1
CVE-2025-2561
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤3.8.24Update to 3.8.25
CVE-2024-13470
Medium6.3Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤3.8.22Update to 3.8.23
CVE-2024-12238
High7.2Unauthenticated Stored Cross-Site Scripting via Form Calculations
≤3.8.19Update to 3.8.20
CVE-2024-11052
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.8.17Update to 3.8.18
CVE-2024-50515
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.8.17Update to 3.8.18
CVE-2024-50514
Medium4.7Reflected Self-Based Cross-Site Scripting via Referer
≤3.8.15Update to 3.8.16
CVE-2024-3866
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.8.11Update to 3.8.12
CVE-2024-43999
Medium6.1Reflected Cross-Site Scripting
3.8.6 – 3.8.10Update to 3.8.11
CVE-2024-7354
Medium4.3Cross-Site Request Forgery
≤3.8.6Update to 3.8.7
CVE-2024-39628
Medium4.3Authenticated (Subscriber+) Arbitrary Shortcode Execution
≤3.8.4Update to 3.8.5
CVE-2024-37934
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.8.0Update to 3.8.1
CVE-2024-29220
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.8.0Update to 3.8.1
CVE-2024-26019
Medium4.6Authenticated (Author+) Stored Cross-Site Scripting
≤3.8.0Update to 3.8.1
CVE-2024-2108
Medium4.3Cross-Site Request Forgery to Publicly Accessible Form Submission Export
≤3.8.0Update to 3.8.1
CVE-2024-2113
Medium5.9Unauthenticated Second Order SQL Injection
≤3.7.1Update to 3.7.2
CVE-2024-0685
Medium4.4Authenticated (Admin+) Stored Cross-Site Scripting
≤3.6.33Update to 3.6.34
CVE-2023-5530
Medium4.4Authenticated (Administrator+) Stored HTML Injection
≤3.6.25Update to 3.6.26
CVE-2023-4109
Medium6.1Reflected Cross-Site Scripting via 'data'
≤3.6.25Update to 3.6.26
CVE-2023-37979
Medium4.3Missing Authorization to Form Submission Export
≤3.6.25Update to 3.6.26
CVE-2023-38393
Medium5.3Missing Authorization to Contributor+ Form Submission Export
≤3.6.25Update to 3.6.26
CVE-2023-38386
Medium5.3Denial of Service via Large Form Submissions
≤3.6.25Update to 3.6.26
CVE-2023-35909
Medium6.5Authenticated (Admin+) Arbitrary File Deletion
≤3.6.24Update to 3.6.25
CVE-2023-36505
Medium6.1Reflected Cross-Site Scripting via 'title'
≤3.6.21Update to 3.6.22
CVE-2023-1835
High7.2Authenticated (Administrator+) PHP Objection Injection
≤3.6.12Update to 3.6.13
CVE-2022-2903
Critical9.8Code Injection
≤3.6.10Update to 3.0.34.2 or 3.1.10 or 3.2.28 or 3.3.21.4 or 3.4.34.2 or 3.5.8.4 or 3.6.11
—
Medium4.8Cross-Site Scripting via field label
≤3.6.9Update to 3.6.10
CVE-2021-25056
Medium5.5Authenticated (Admin+) Stored Cross-Site Scripting via import
≤3.6.10Update to 3.6.11
CVE-2021-25066
Medium5.5Authenticated (Admin+) Cross-Site Scripting via label
≤3.6.9Update to 3.6.10
CVE-2021-36827
High8.8Cross-Site Request Forgery to Field Import and PHP Object Injection
≤3.6.9Update to 3.6.10
—
Medium5.3Email Address Disclosure
≤3.6.7Update to 3.6.8
—
High7.2Authenticated SQL Injection
<3.6.4Update to 3.6.4
CVE-2021-24889
Medium4.8Cross-Site Scripting
<3.5.8.2Update to 3.5.8.2
CVE-2021-24381
Medium6.4Unprotected REST-API to Email Injection
≤3.5.7Update to 3.5.8
CVE-2021-34648
Medium6.5Unprotected REST-API to Sensitive Information Disclosure
≤3.5.7Update to 3.5.8
CVE-2021-34647
Medium5.4Cross-Site Request Forgery to OAuth Service Disconnection
<3.4.34Update to 3.4.34
CVE-2021-24166
Medium4.3Authenticated OAuth Connection Key Disclosure
<3.4.34.1Update to 3.4.34.1
CVE-2021-24164
Medium6.1Administrator Open Redirect
<3.4.34Update to 3.4.34
CVE-2021-24165
High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
<3.4.34Update to 3.4.34
CVE-2021-24163
High8.8Cross-Site Request Forgery to Plugin Installation
≤3.4.27Update to 3.4.27.1
CVE-2020-36174
Medium5.3Validation Bypass via Email Field
≤3.4.27Update to 3.4.27.1
CVE-2020-36175
Medium6.5Stored Cross-Site Scripting
≤3.4.27.1Update to 3.4.28
CVE-2020-36173
Medium6.1Cross-Site Request Forgery leading to Stored Cross-Site Scripting
<3.4.24.2Update to 3.4.24.2
CVE-2020-12462
Medium6.4Stored Cross-Site Scripting
<3.4.23Update to 3.4.23
CVE-2020-8594
Critical9.8SQL Injection
≤3.3.21.1Update to 3.3.21.2
CVE-2019-15025
Medium4.7Authenticated Open Redirect
≤3.3.19Update to 3.3.19.1
CVE-2018-19796
Medium6.1Cross-Site Scripting via begin_date, end_date, or form_id Parameter
<3.3.18Update to 3.3.18
CVE-2018-19287
High8.3Cross-Site Scripting
<3.3.14Update to 3.3.14
—
High8.6CSV Injection
≤3.3.13Update to 3.3.14
CVE-2018-16308
Critical9.1Insufficient Restrictions during Export Personal Data requests
≤3.3.8Update to 3.3.9
CVE-2018-20981
High7.5Parameter Tampering
<3.2.15Update to 3.2.15
CVE-2018-20980
Medium6.1Cross-Site Scripting
<3.2.14Update to 3.2.14
CVE-2018-7280
Medium5.3Arbitrary Wordpress Shortcode Injection
≤3.0.31Update to 3.0.32
—
Medium6.1HTML Injection
<3.0.31Update to 3.0.31
CVE-2017-18574
High8.8Authenticated SQL Injection
<2.9.55.2Update to 2.9.55.2
—
Medium6.1Multiple Reflected Cross-Site Scripting
<2.9.52Update to 2.9.52
—
High8.12.9.42 - PHP Object Injection
2.9.36 – 2.9.42Update to 2.9.42.1
CVE-2016-1209
Critical9.82.9.42 - Unauthenticated Arbitrary File Upload
2.9.36 – 2.9.42Update to 2.9.42.1
—
High7.2Stored Cross-Site Scripting
≤2.9.28Update to 2.9.29
—
High8.4CSV Injection
≤2.9.27Update to 2.9.28
—
Medium5.4Reflected Cross-Site Scripting
≤2.9.21Update to 2.9.22
—
Medium6.1Cross-Site Scripting
≤2.9.18Update to 2.9.19
—
Medium6.1Reflected Cross-Site Scripting
<2.9.11Update to 2.9.11
—
Medium6.1Reflected Cross-Site Scripting
<2.8.10Update to 2.8.10
CVE-2014-9688
High7.2Stored Cross-Site Scripting
<2.8.9Update to 2.8.9
CVE-2015-2220
Medium6.1Reflected Cross-Site Scripting
≤2.8.6Update to 2.8.7
CVE-2014-8815

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: common questions

Does Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder have known vulnerabilities?

Yes. VulnCrest Radar lists 95 known vulnerabilities in Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: 4 critical, 28 high, 62 medium, 1 low. None are known to affect version null.

How do I check which version of Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerability?

CVE-2026-100151, published Oct 30, 2026: Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter. Severity: Medium (CVSS 6.1).

Is any Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerability listed in CISA KEV?

No. None of the known Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?