Plugin security history

Ninja Forms – The Contact Form Builder That Grows With You Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 78 vulnerability records associated with Ninja Forms – The Contact Form Builder That Grows With You, published between 2014 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

78Total records

4Critical

19High

55Medium

0Low

0Informational

78Patched records

0Currently marked unpatched

2014-11-06First disclosure

2026-07-23Latest disclosure

66 of 78CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	3	3 records
2015	5	5 records
2016	4	4 records
2017	2	2 records
2018	7	7 records
2019	1	1 records
2020	5	5 records
2021	8	8 records
2022	7	7 records
2023	8	8 records
2024	14	14 records
2025	10	10 records
2026	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	4	5.1%
High	19	24.4%
Medium	55	70.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

35 records44.9%

First: 2014. Latest: 2025.

Other

15 records19.2%

First: 2015. Latest: 2025.

CSRF

8 records10.3%

First: 2020. Latest: 2025.

Missing Authorization

8 records10.3%

First: 2021. Latest: 2026.

SQL Injection

5 records6.4%

First: 2016. Latest: 2026.

Information Disclosure

5 records6.4%

First: 2021. Latest: 2026.

Arbitrary File Upload

1 record1.3%

First: 2016. Latest: 2016.

Path Traversal

1 record1.3%

First: 2023. Latest: 2023.

Patch Status

Patched: 78
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.14.10
3.14.2
3.14.1
3.13.3
3.12.1
3.11.1
3.10.2.2
3.10.1
3.8.25
3.8.23
3.8.20
3.8.18
3.8.16
3.8.12
3.8.11
3.8.7
3.8.5
3.8.1
3.7.2
3.6.34
3.6.26
3.6.25
3.6.22
3.6.13
3.5.8.4
3.4.34.2
3.3.21.4
3.2.28
3.1.10
3.0.34.2
3.6.11
3.6.10
3.6.8
3.6.4
3.5.8.2
3.5.8
3.4.34.1
3.4.34
3.4.27.1
3.4.28
3.4.24.2
3.4.23
3.3.21.2
3.3.19.1
3.3.18
3.3.14
3.3.9
3.2.15
3.2.14
3.0.32

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.8.0`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting	March 28, 2024	3.8.1	Medium
`*-3.8.0`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export	March 28, 2024	3.8.1	Medium
`*-3.7.1`	Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection	February 1, 2024	3.7.2	Medium
`*-3.6.33`	Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting	October 16, 2023	3.6.34	Medium
`*-3.6.25`	Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection	August 7, 2023	3.6.26	Medium
`*-3.6.25`	Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export	July 25, 2023	3.6.26	Medium
`*-3.6.25`	Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export	July 25, 2023	3.6.26	Medium
`*-3.6.25`	Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data'	July 25, 2023	3.6.26	Medium
`*-3.6.25`	Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions	July 7, 2023	3.6.26	Medium
`*-3.6.24`	Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion	June 22, 2023	3.6.25	Medium
`*-3.6.21`	Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title'	April 24, 2023	3.6.22	Medium
`*-3.6.12`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection	September 5, 2022	3.6.13	High
`3.6-3.6.10`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`3.5-3.5.8.3`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`3.4-3.4.34.1`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`3.3-3.3.21.3`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`3.2-3.2.27`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`3.1-3.1.9`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`*-3.0.34.1`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection	June 15, 2022	3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11	Critical
`*-3.6.9`	Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label	June 13, 2022	3.6.10	Medium
`*-3.6.10`	Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import	June 10, 2022	3.6.11	Medium
`*-3.6.9`	Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label	June 7, 2022	3.6.10	Medium
`*-3.6.9`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection	June 7, 2022	3.6.10	High
`*-3.6.7`	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure	March 22, 2022	3.6.8	Medium
`[*, 3.6.4)`	Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection	October 26, 2021	3.6.4	High

Selected source records

Latest Records

MediumCVE-2026-15663

Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key

Published: July 23, 2026

Affected versions: *-3.14.9
Patched versions: 3.14.10

Original Wordfence record

HighCVE-2026-1239

Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint

Published: June 30, 2026

Affected versions: *-3.14.1
Patched versions: 3.14.2

Original Wordfence record

MediumCVE-2026-1307

Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token

Published: March 27, 2026

Affected versions: *-3.14.1
Patched versions: 3.14.2

Original Wordfence record

HighCVE-2026-2268

Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

Published: February 9, 2026

Affected versions: *-3.14.0
Patched versions: 3.14.1

Original Wordfence record

HighCVE-2025-11924

Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

Published: December 16, 2025

Affected versions: *-3.13.2
Patched versions: 3.13.3

Original Wordfence record

HighCVE-2025-14072

Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure

Published: December 12, 2025

Affected versions: *-3.13.2
Patched versions: 3.13.3

Original Wordfence record

MediumCVE-2025-10499

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

Published: September 26, 2025

Affected versions: *-3.12.0
Patched versions: 3.12.1

Original Wordfence record

MediumCVE-2025-10498

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

Published: September 26, 2025

Affected versions: *-3.12.0
Patched versions: 3.12.1

Original Wordfence record

Highest-Severity Records

CriticalCVE-2016-1209

Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload

Published: May 5, 2016

Affected versions: 2.9.36-2.9.42
Patched versions: 2.9.42.1

Original Wordfence record

CriticalCVE-2019-15025

Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection

Published: January 7, 2019

Affected versions: *-3.3.21.1
Patched versions: 3.3.21.2

Original Wordfence record

Critical

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection

Published: June 15, 2022

Affected versions: *-3.0.34.1; 3.1-3.1.9; 3.2-3.2.27; 3.3-3.3.21.3; 3.4-3.4.34.1; 3.5-3.5.8.3; 3.6-3.6.10
Patched versions: 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11

Original Wordfence record

CriticalCVE-2018-20981

Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests

Published: July 6, 2018

Affected versions: *-3.3.8
Patched versions: 3.3.9

Original Wordfence record

HighCVE-2021-24163

Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

Published: February 16, 2021

Affected versions: [*, 3.4.34)
Patched versions: 3.4.34

Original Wordfence record

High

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection

Published: June 7, 2022

Affected versions: *-3.6.9
Patched versions: 3.6.10

Original Wordfence record

High

Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection

Published: August 16, 2016

Affected versions: [*, 2.9.55.2)
Patched versions: 2.9.55.2

Original Wordfence record

HighCVE-2020-36174

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation

Published: September 22, 2020

Affected versions: *-3.4.27
Patched versions: 3.4.27.1

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory