Cross-Site Scripting
35 records44.9%First: 2014. Latest: 2025.
Plugin security history
Ninja Forms – The Contact Form Builder That Grows With You Vulnerability History & Security Timeline
The Wordfence Intelligence dataset currently contains 78 vulnerability records associated with Ninja Forms – The Contact Form Builder That Grows With You, published between 2014 and 2026.
Dataset last synchronized: 2026-08-02 09:41:47 UTC
At a glance
Security Snapshot
78Total records
4Critical
19High
55Medium
0Low
0Informational
78Patched records
0Currently marked unpatched
2014-11-06First disclosure
2026-07-23Latest disclosure
66 of 78CVE coverage
Year-by-Year Timeline
| Year | Records | Relative volume |
|---|---|---|
| 2014 | 3 | |
| 2015 | 5 | |
| 2016 | 4 | |
| 2017 | 2 | |
| 2018 | 7 | |
| 2019 | 1 | |
| 2020 | 5 | |
| 2021 | 8 | |
| 2022 | 7 | |
| 2023 | 8 | |
| 2024 | 14 | |
| 2025 | 10 | |
| 2026 | 4 |
Severity Breakdown
| Severity | Records | Share |
|---|---|---|
| Critical | 4 | 5.1% |
| High | 19 | 24.4% |
| Medium | 55 | 70.5% |
Vulnerability-Type Breakdown
Other
15 records19.2%First: 2015. Latest: 2025.
CSRF
8 records10.3%First: 2020. Latest: 2025.
Missing Authorization
8 records10.3%First: 2021. Latest: 2026.
SQL Injection
5 records6.4%First: 2016. Latest: 2026.
Information Disclosure
5 records6.4%First: 2021. Latest: 2026.
Arbitrary File Upload
1 record1.3%First: 2016. Latest: 2016.
Path Traversal
1 record1.3%First: 2023. Latest: 2023.
Patch Status
- Patched
- 78
- Currently marked unpatched
- 0
- Unknown status
- 0
Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.
Latest Known Patched Versions
3.14.103.14.23.14.13.13.33.12.13.11.13.10.2.23.10.13.8.253.8.233.8.203.8.183.8.163.8.123.8.113.8.73.8.53.8.13.7.23.6.343.6.263.6.253.6.223.6.133.5.8.43.4.34.23.3.21.43.2.283.1.103.0.34.23.6.113.6.103.6.83.6.43.5.8.23.5.83.4.34.13.4.343.4.27.13.4.283.4.24.23.4.233.3.21.23.3.19.13.3.183.3.143.3.93.2.153.2.143.0.32
Affected-Version History
Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.
| Affected range | Vulnerability | Published | Patched version | Severity |
|---|---|---|---|---|
2.9.36-2.9.42 | Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload | May 5, 2016 | 2.9.42.1 | Critical |
*-2.9.28 | Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting | December 8, 2015 | 2.9.29 | High |
*-2.9.27 | Ninja Forms Contact Form <= 2.9.27 - CSV Injection | September 30, 2015 | 2.9.28 | High |
*-2.9.21 | Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting | August 4, 2015 | 2.9.22 | Medium |
*-2.9.18 | Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting | June 5, 2015 | 2.9.19 | Medium |
[*, 2.9.11) | Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting | April 20, 2015 | 2.9.11 | Medium |
[*, 2.8.10) | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting | December 2, 2014 | 2.8.10 | Medium |
[*, 2.8.9) | Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting | November 20, 2014 | 2.8.9 | High |
*-2.8.6 | Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting | November 6, 2014 | 2.8.7 | Medium |
Selected source records
Latest Records
MediumCVE-2026-15663
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
Published: July 23, 2026
- Affected versions
- *-3.14.9
- Patched versions
- 3.14.10
HighCVE-2026-1239
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
Published: June 30, 2026
- Affected versions
- *-3.14.1
- Patched versions
- 3.14.2
MediumCVE-2026-1307
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
Published: March 27, 2026
- Affected versions
- *-3.14.1
- Patched versions
- 3.14.2
HighCVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Published: February 9, 2026
- Affected versions
- *-3.14.0
- Patched versions
- 3.14.1
HighCVE-2025-11924
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
Published: December 16, 2025
- Affected versions
- *-3.13.2
- Patched versions
- 3.13.3
HighCVE-2025-14072
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
Published: December 12, 2025
- Affected versions
- *-3.13.2
- Patched versions
- 3.13.3
MediumCVE-2025-10499
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
Published: September 26, 2025
- Affected versions
- *-3.12.0
- Patched versions
- 3.12.1
MediumCVE-2025-10498
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
Published: September 26, 2025
- Affected versions
- *-3.12.0
- Patched versions
- 3.12.1
Highest-Severity Records
CriticalCVE-2016-1209
Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload
Published: May 5, 2016
- Affected versions
- 2.9.36-2.9.42
- Patched versions
- 2.9.42.1
CriticalCVE-2019-15025
Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection
Published: January 7, 2019
- Affected versions
- *-3.3.21.1
- Patched versions
- 3.3.21.2
Critical
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection
Published: June 15, 2022
- Affected versions
- *-3.0.34.1; 3.1-3.1.9; 3.2-3.2.27; 3.3-3.3.21.3; 3.4-3.4.34.1; 3.5-3.5.8.3; 3.6-3.6.10
- Patched versions
- 3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11
CriticalCVE-2018-20981
Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests
Published: July 6, 2018
- Affected versions
- *-3.3.8
- Patched versions
- 3.3.9
HighCVE-2021-24163
Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
Published: February 16, 2021
- Affected versions
- [*, 3.4.34)
- Patched versions
- 3.4.34
High
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection
Published: June 7, 2022
- Affected versions
- *-3.6.9
- Patched versions
- 3.6.10
High
Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection
Published: August 16, 2016
- Affected versions
- [*, 2.9.55.2)
- Patched versions
- 2.9.55.2
HighCVE-2020-36174
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation
Published: September 22, 2020
- Affected versions
- *-3.4.27
- Patched versions
- 3.4.27.1
Need help reviewing an exposed WordPress website?
Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.
Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.
Data Source, Attribution and Methodology
This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.