Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder vulnerabilities
Plugin slug ninja-forms · 95 known vulnerabilities · latest disclosed 2026-10-30 · WordPress.org page
Every listed vulnerability has a fix. Version 3.15.6 or later is not affected by any of them. If your site runs an older version, update it.
32 of 95 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| Medium 6.1 | <= 3.15.5 | 3.15.6 | CVE-2026-100151 | 2026-10-30 | Advisory |
| Medium 6.5 | <= 3.15.5 | 3.15.6 | CVE-2026-100155 | 2026-10-30 | Advisory |
| Medium 5.4 | <= 3.15.5 | 3.15.6 | CVE-2026-101326 | 2026-10-30 | Advisory |
| High 7.2 | <= 3.15.5 | 3.15.6 | CVE-2026-109997 | 2026-10-30 | Advisory |
| Medium 5.8 | <= 3.15.3 | 3.15.4 | CVE-2026-67187 | 2026-10-28 | Advisory |
| High 7.2 | <= 3.15.5 | 3.15.6 | CVE-2026-110899 | 2026-10-19 | Advisory |
| High 7.2 | <= 3.15.4 | 3.15.5 | CVE-2026-90438 | 2026-10-01 | Advisory |
| High 7.2 | <= 3.15.3 | 3.15.5 | CVE-2026-102385 | 2026-09-30 | Advisory |
| High 7.2 | <= 3.15.3 | 3.15.4 | CVE-2026-95515 | 2026-09-23 | Advisory |
| High 7.2 | <= 3.15.3 | 3.15.4 | CVE-2026-92438 | 2026-09-22 | Advisory |
| High 8.1 | <= 3.15.3 | 3.15.4 | CVE-2026-91827 | 2026-09-22 | Advisory |
| High 7.2 | <= 3.15.3 | 3.15.4 | CVE-2026-94504 | 2026-09-21 | Advisory |
| Medium 6.6 | <= 3.14.6 | 3.14.7 | CVE-2026-11363 | 2026-09-08 | Advisory |
| High 7.2 | <= 3.15.1 | 3.15.2 | CVE-2026-19769 | 2026-09-04 | Advisory |
| Medium 6.5 | 3.14.10 to 3.15.1 | 3.15.2 | CVE-2026-80437 | 2026-09-04 | Advisory |
| Low 3.1 | 3.14.0 to 3.15.1 | 3.15.2 | CVE-2026-80438 | 2026-09-02 | Advisory |
| Medium 5.3 | <= 3.14.9 | 3.14.10 | CVE-2026-15256 | 2026-07-27 | Advisory |
| Medium 4.9 | <= 3.14.9 | 3.14.10 | CVE-2026-15663 | 2026-07-23 | Advisory |
| High 7.5 | <= 3.14.1 | 3.14.2 | CVE-2026-1239 | 2026-06-30 | Advisory |
| Medium 6.5 | <= 3.14.1 | 3.14.2 | CVE-2026-1307 | 2026-03-27 | Advisory |
| High 7.5 | <= 3.14.0 | 3.14.1 | CVE-2026-2268 | 2026-02-09 | Advisory |
| High 7.5 | <= 3.13.2 | 3.13.3 | CVE-2025-11924 | 2025-12-16 | Advisory |
| High 7.5 | <= 3.13.2 | 3.13.3 | CVE-2025-14072 | 2025-12-12 | Advisory |
| Medium 4.3 | <= 3.12.0 | 3.12.1 | CVE-2025-10499 | 2025-09-26 | Advisory |
| Medium 4.3 | <= 3.12.0 | 3.12.1 | CVE-2025-10498 | 2025-09-26 | Advisory |
| High 8.1 | <= 3.11.0 | 3.11.1 | CVE-2025-9083 | 2025-08-28 | Advisory |
| Medium 6.4 | <= 3.10.2.1 | 3.10.2.2 | CVE-2025-5398 | 2025-06-26 | Advisory |
| Medium 4.4 | <= 3.10.0 | 3.10.1 | CVE-2025-2561 | 2025-04-28 | Advisory |
| Medium 4.4 | <= 3.10.0 | 3.10.1 | CVE-2025-2560 | 2025-04-28 | Advisory |
| Medium 4.4 | <= 3.10.0 | 3.10.1 | CVE-2025-2524 | 2025-04-28 | Advisory |
| Medium 6.4 | <= 3.8.24 | 3.8.25 | CVE-2024-13470 | 2025-01-29 | Advisory |
| Medium 6.3 | <= 3.8.22 | 3.8.23 | CVE-2024-12238 | 2024-12-28 | Advisory |
| High 7.2 | <= 3.8.19 | 3.8.20 | CVE-2024-11052 | 2024-12-11 | Advisory |
| Medium 4.4 | <= 3.8.17 | 3.8.18 | CVE-2024-50515 | 2024-10-28 | Advisory |
| Medium 4.4 | <= 3.8.17 | 3.8.18 | CVE-2024-50514 | 2024-10-28 | Advisory |
| Medium 4.7 | <= 3.8.15 | 3.8.16 | CVE-2024-3866 | 2024-09-24 | Advisory |
| Medium 4.4 | <= 3.8.11 | 3.8.12 | CVE-2024-43999 | 2024-08-28 | Advisory |
| Medium 6.1 | 3.8.6 to 3.8.10 | 3.8.11 | CVE-2024-7354 | 2024-08-12 | Advisory |
| Medium 4.3 | <= 3.8.6 | 3.8.7 | CVE-2024-39628 | 2024-07-24 | Advisory |
| Medium 4.3 | <= 3.8.4 | 3.8.5 | CVE-2024-37934 | 2024-07-04 | Advisory |
| Medium 4.4 | <= 3.8.0 | 3.8.1 | CVE-2024-26019 | 2024-04-08 | Advisory |
| Medium 4.4 | <= 3.8.0 | 3.8.1 | CVE-2024-29220 | 2024-04-08 | Advisory |
| Medium 4.3 | <= 3.8.0 | 3.8.1 | CVE-2024-2113 | 2024-03-28 | Advisory |
| Medium 4.6 | <= 3.8.0 | 3.8.1 | CVE-2024-2108 | 2024-03-28 | Advisory |
| Medium 5.9 | <= 3.7.1 | 3.7.2 | CVE-2024-0685 | 2024-02-01 | Advisory |
| Medium 4.4 | <= 3.6.33 | 3.6.34 | CVE-2023-5530 | 2023-10-16 | Advisory |
| Medium 4.4 | <= 3.6.25 | 3.6.26 | CVE-2023-4109 | 2023-08-07 | Advisory |
| Medium 6.1 | <= 3.6.25 | 3.6.26 | CVE-2023-37979 | 2023-07-25 | Advisory |
| Medium 5.3 | <= 3.6.25 | 3.6.26 | CVE-2023-38386 | 2023-07-25 | Advisory |
| Medium 4.3 | <= 3.6.25 | 3.6.26 | CVE-2023-38393 | 2023-07-25 | Advisory |
| Medium 5.3 | <= 3.6.25 | 3.6.26 | CVE-2023-35909 | 2023-07-07 | Advisory |
| Medium 6.5 | <= 3.6.24 | 3.6.25 | CVE-2023-36505 | 2023-06-22 | Advisory |
| Medium 6.1 | <= 3.6.21 | 3.6.22 | CVE-2023-1835 | 2023-04-24 | Advisory |
| High 7.2 | <= 3.6.12 | 3.6.13 | CVE-2022-2903 | 2022-09-05 | Advisory |
| Critical 9.8 | <= 3.0.34.1, 3.1 to 3.1.9, 3.2 to 3.2.27, 3.3 to 3.3.21.3, 3.4 to 3.4.34.1, 3.5 to 3.5.8.3, 3.6 to 3.6.10 | 3.0.34.2 | none | 2022-06-15 | Advisory |
| Medium 4.8 | <= 3.6.9 | 3.6.10 | CVE-2021-25056 | 2022-06-13 | Advisory |
| Medium 5.5 | <= 3.6.10 | 3.6.11 | CVE-2021-25066 | 2022-06-10 | Advisory |
| Medium 5.5 | <= 3.6.9 | 3.6.10 | CVE-2021-36827 | 2022-06-07 | Advisory |
| High 8.8 | <= 3.6.9 | 3.6.10 | none | 2022-06-07 | Advisory |
| Medium 5.3 | <= 3.6.7 | 3.6.8 | none | 2022-03-22 | Advisory |
| High 7.2 | < 3.6.4 | 3.6.4 | CVE-2021-24889 | 2021-10-26 | Advisory |
| Medium 4.8 | < 3.5.8.2 | 3.5.8.2 | CVE-2021-24381 | 2021-09-27 | Advisory |
| Medium 6.5 | <= 3.5.7 | 3.5.8 | CVE-2021-34647 | 2021-09-22 | Advisory |
| Medium 6.4 | <= 3.5.7 | 3.5.8 | CVE-2021-34648 | 2021-09-22 | Advisory |
| Medium 6.1 | < 3.4.34 | 3.4.34 | CVE-2021-24165 | 2021-02-16 | Advisory |
| High 8.8 | < 3.4.34 | 3.4.34 | CVE-2021-24163 | 2021-02-16 | Advisory |
| Medium 4.3 | < 3.4.34.1 | 3.4.34.1 | CVE-2021-24164 | 2021-02-16 | Advisory |
| Medium 5.4 | < 3.4.34 | 3.4.34 | CVE-2021-24166 | 2021-02-16 | Advisory |
| Medium 5.3 | <= 3.4.27 | 3.4.27.1 | CVE-2020-36175 | 2020-09-22 | Advisory |
| High 8.8 | <= 3.4.27 | 3.4.27.1 | CVE-2020-36174 | 2020-09-22 | Advisory |
| Medium 6.5 | <= 3.4.27.1 | 3.4.28 | CVE-2020-36173 | 2020-09-20 | Advisory |
| Medium 6.1 | < 3.4.24.2 | 3.4.24.2 | CVE-2020-12462 | 2020-04-28 | Advisory |
| Medium 6.4 | < 3.4.23 | 3.4.23 | CVE-2020-8594 | 2020-02-03 | Advisory |
| Critical 9.8 | <= 3.3.21.1 | 3.3.21.2 | CVE-2019-15025 | 2019-01-07 | Advisory |
| Medium 4.7 | <= 3.3.19 | 3.3.19.1 | CVE-2018-19796 | 2018-12-01 | Advisory |
| Medium 6.1 | < 3.3.18 | 3.3.18 | CVE-2018-19287 | 2018-11-15 | Advisory |
| High 8.3 | < 3.3.14 | 3.3.14 | none | 2018-08-27 | Advisory |
| High 8.6 | <= 3.3.13 | 3.3.14 | CVE-2018-16308 | 2018-08-19 | Advisory |
| Critical 9.1 | <= 3.3.8 | 3.3.9 | CVE-2018-20981 | 2018-07-06 | Advisory |
| High 7.5 | < 3.2.15 | 3.2.15 | CVE-2018-20980 | 2018-02-26 | Advisory |
| Medium 6.1 | < 3.2.14 | 3.2.14 | CVE-2018-7280 | 2018-02-20 | Advisory |
| Medium 5.3 | <= 3.0.31 | 3.0.32 | none | 2017-04-17 | Advisory |
| Medium 6.1 | < 3.0.31 | 3.0.31 | CVE-2017-18574 | 2017-03-07 | Advisory |
| High 8.8 | < 2.9.55.2 | 2.9.55.2 | none | 2016-08-16 | Advisory |
| Medium 6.1 | < 2.9.52 | 2.9.52 | none | 2016-07-19 | Advisory |
| High 8.1 | 2.9.36 to 2.9.42 | 2.9.42.1 | CVE-2016-1209 | 2016-05-13 | Advisory |
| Critical 9.8 | 2.9.36 to 2.9.42 | 2.9.42.1 | CVE-2016-1209 | 2016-05-05 | Advisory |
| High 7.2 | <= 2.9.28 | 2.9.29 | none | 2015-12-08 | Advisory |
| High 8.4 | <= 2.9.27 | 2.9.28 | none | 2015-09-30 | Advisory |
| Medium 5.4 | <= 2.9.21 | 2.9.22 | none | 2015-08-04 | Advisory |
| Medium 6.1 | <= 2.9.18 | 2.9.19 | none | 2015-06-05 | Advisory |
| Medium 6.1 | < 2.9.11 | 2.9.11 | none | 2015-04-20 | Advisory |
| Medium 6.1 | < 2.8.10 | 2.8.10 | CVE-2014-9688 | 2014-12-02 | Advisory |
| High 7.2 | < 2.8.9 | 2.8.9 | CVE-2015-2220 | 2014-11-20 | Advisory |
| Medium 6.1 | <= 2.8.6 | 2.8.7 | CVE-2014-8815 | 2014-11-06 | Advisory |
Check if a site is affected
Enter a site address to see which version of Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin safe to use?
All 95 known issues are fixed in current versions (3.15.6 or later). Keeping it updated is what matters.
How do I check which version of Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome