VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder security & vulnerabilities

ninja-forms— active installsLast vulnerability Oct 30, 2026

No known unpatched vulnerabilities in the latest version

All 95 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin
95Known vulnerabilities
  • Critical4
  • High28
  • Medium62
  • Low1
Vulnerabilities per year
2014: 3 vulnerabilities3142015: 5 vulnerabilities5152016: 4 vulnerabilities4162017: 2 vulnerabilities2172018: 7 vulnerabilities7182019: 1 vulnerability1192020: 5 vulnerabilities5202021: 8 vulnerabilities8212022: 7 vulnerabilities7222023: 8 vulnerabilities8232024: 14 vulnerabilities14242025: 10 vulnerabilities10252026: 21 vulnerabilities2126

All Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities
SeverityVulnerabilityCVEPublished
High7.2Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
≤3.15.5Update to 3.15.6
CVE-2026-109997
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.5Update to 3.15.6
CVE-2026-110899
High7.2Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
≤3.15.4Update to 3.15.5
CVE-2026-90438
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.5
CVE-2026-102385
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-95515
High8.1Unauthenticated PHP Object Injection
≤3.15.3Update to 3.15.4
CVE-2026-91827
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-92438
High7.2Unauthenticated Stored Cross-Site Scripting
≤3.15.3Update to 3.15.4
CVE-2026-94504
High7.2Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
≤3.15.1Update to 3.15.2
CVE-2026-19769
High7.5Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
≤3.14.1Update to 3.14.2
CVE-2026-1239
High7.5Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
≤3.14.0Update to 3.14.1
CVE-2026-2268
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
≤3.13.2Update to 3.13.3
CVE-2025-11924
High7.5Missing Authorization to Unauthenticated Submission Disclosure
≤3.13.2Update to 3.13.3
CVE-2025-14072
High8.1Unauthenticated PHP Object Injection
≤3.11.0Update to 3.11.1
CVE-2025-9083
High7.2Unauthenticated Stored Cross-Site Scripting via Form Calculations
≤3.8.19Update to 3.8.20
CVE-2024-11052
High7.2Authenticated (Administrator+) PHP Objection Injection
≤3.6.12Update to 3.6.13
CVE-2022-2903
Critical9.8Code Injection
≤3.6.10Update to 3.0.34.2 or 3.1.10 or 3.2.28 or 3.3.21.4 or 3.4.34.2 or 3.5.8.4 or 3.6.11
—
High8.8Cross-Site Request Forgery to Field Import and PHP Object Injection
≤3.6.9Update to 3.6.10
—
High7.2Authenticated SQL Injection
<3.6.4Update to 3.6.4
CVE-2021-24889
High8.8Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
<3.4.34Update to 3.4.34
CVE-2021-24163
High8.8Cross-Site Request Forgery to Plugin Installation
≤3.4.27Update to 3.4.27.1
CVE-2020-36174
Critical9.8SQL Injection
≤3.3.21.1Update to 3.3.21.2
CVE-2019-15025
High8.3Cross-Site Scripting
<3.3.14Update to 3.3.14
—
High8.6CSV Injection
≤3.3.13Update to 3.3.14
CVE-2018-16308
Critical9.1Insufficient Restrictions during Export Personal Data requests
≤3.3.8Update to 3.3.9
CVE-2018-20981
High7.5Parameter Tampering
<3.2.15Update to 3.2.15
CVE-2018-20980
High8.8Authenticated SQL Injection
<2.9.55.2Update to 2.9.55.2
—
High8.12.9.42 - PHP Object Injection
2.9.36 – 2.9.42Update to 2.9.42.1
CVE-2016-1209
Critical9.82.9.42 - Unauthenticated Arbitrary File Upload
2.9.36 – 2.9.42Update to 2.9.42.1
—
High7.2Stored Cross-Site Scripting
≤2.9.28Update to 2.9.29
—
High8.4CSV Injection
≤2.9.27Update to 2.9.28
—
High7.2Stored Cross-Site Scripting
<2.8.9Update to 2.8.9
CVE-2015-2220

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: common questions

Does Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder have known vulnerabilities?

Yes. VulnCrest Radar lists 95 known vulnerabilities in Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: 4 critical, 28 high, 62 medium, 1 low. None are known to affect version null.

How do I check which version of Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerability?

CVE-2026-100151, published Oct 30, 2026: Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter. Severity: Medium (CVSS 6.1).

Is any Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerability listed in CISA KEV?

No. None of the known Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?