EN ES
Start free
Menu

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: known security problems

94 known security problems reported for this WordPress plugin, with the affected versions, the fix and what to do.

Updated

In short

There are 94 known security problems on this page. Each one has a fixed version. Updating to version 3.15.6 or newer covers every fixed problem listed here.

Based on public reports. Check the plugin’s changelog. Watchfox AI may be wrong.

Get an email when your site is affected: install Watchfox AI (free)

This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.6 or newer.
Official ID
CVE-2026-100151
Report title
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.6 or newer.
Official ID
CVE-2026-100155
Report title
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.6 or newer.
Official ID
CVE-2026-101326
Report title
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.5)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.6 or newer.
Official ID
CVE-2026-109997
Report title
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.5) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.5
Fixed in
3.15.6
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.6 or newer.
Official ID
CVE-2026-110899
Report title
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.4
Fixed in
3.15.5
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.5 or newer.
Official ID
CVE-2026-90438
Report title
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.3
Fixed in
3.15.5
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.5 or newer.
Official ID
CVE-2026-102385
Report title
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.3) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.3
Fixed in
3.15.4
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.4 or newer.
Official ID
CVE-2026-95515
Report title
Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.3) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.3
Fixed in
3.15.4
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.4 or newer.
Official ID
CVE-2026-92438
Report title
Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could in some setups, take over your site (up to and including 3.15.3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.3
Fixed in
3.15.4
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.4 or newer.
Official ID
CVE-2026-91827
Report title
Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.3) (4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.3
Fixed in
3.15.4
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.4 or newer.
Official ID
CVE-2026-94504
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.6
Fixed in
3.14.7
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.7 or newer.
Official ID
CVE-2026-11363
Report title
Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.15.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.15.1
Fixed in
3.15.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.2 or newer.
Official ID
CVE-2026-19769
Report title
Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key
First reported
Sources
This week

A stranger could use it to harm your site (from 3.14.10 up to and including 3.15.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.14.10 up to and including 3.15.1
Fixed in
3.15.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.2 or newer.
Official ID
CVE-2026-80437
Report title
Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution
First reported
Sources
This week

Someone could use it to harm your site (from 3.14.0 up to and including 3.15.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.14.0 up to and including 3.15.1
Fixed in
3.15.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.15.2 or newer.
Official ID
CVE-2026-80438
Report title
Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.14.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.9
Fixed in
3.14.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.10 or newer.
Official ID
CVE-2026-15256
Report title
Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution
First reported
Sources
This week

Someone who already has an admin account could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.9
Fixed in
3.14.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.10 or newer.
Official ID
CVE-2026-15663
Report title
Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 3.14.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.1
Fixed in
3.14.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.2 or newer.
Official ID
CVE-2026-1239
Report title
Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint
First reported
Sources
This week

Someone with a contributor account on your site could use it to harm your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.1
Fixed in
3.14.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.2 or newer.
Official ID
CVE-2026-1307
Report title
Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token
First reported
Sources
This week

A stranger could use it to harm your site (up to and including 3.14.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.14.0
Fixed in
3.14.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.14.1 or newer.
Official ID
CVE-2026-2268
Report title
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
First reported
Sources
This week

A stranger could see private information they should not see

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.2
Fixed in
3.13.3
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.13.3 or newer.
Official ID
CVE-2025-11924
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
First reported
Sources
This week

A stranger could do things on your site they should not be allowed to (up to and including 3.13.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.13.2
Fixed in
3.13.3
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.13.3 or newer.
Official ID
CVE-2025-14072
Report title
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.12.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.12.0
Fixed in
3.12.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.12.1 or newer.
Official ID
CVE-2025-10499
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.12.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.12.0
Fixed in
3.12.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.12.1 or newer.
Official ID
CVE-2025-10498
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
First reported
Sources
This week

A stranger could in some setups, take over your site (up to and including 3.11.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.11.0
Fixed in
3.11.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.11.1 or newer.
Official ID
CVE-2025-9083
Report title
Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.10.2.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.2.1
Fixed in
3.10.2.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.10.2.2 or newer.
Official ID
CVE-2025-5398
Report title
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.10.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.0
Fixed in
3.10.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.10.1 or newer.
Official ID
CVE-2025-2561
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.10.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.0
Fixed in
3.10.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.10.1 or newer.
Official ID
CVE-2025-2560
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.10.0) (3)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.10.0
Fixed in
3.10.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.10.1 or newer.
Official ID
CVE-2025-2524
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone with a contributor account on your site could plant harmful code that runs for your visitors or admins (up to and including 3.8.24)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.24
Fixed in
3.8.25
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.25 or newer.
Official ID
CVE-2024-13470
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.8.22)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.22
Fixed in
3.8.23
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.23 or newer.
Official ID
CVE-2024-12238
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
First reported
Sources
This week

A stranger could plant harmful code that runs for your visitors or admins (up to and including 3.8.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.19
Fixed in
3.8.20
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.20 or newer.
Official ID
CVE-2024-11052
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.8.17)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.17
Fixed in
3.8.18
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.18 or newer.
Official ID
CVE-2024-50515
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.8.17) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.17
Fixed in
3.8.18
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.18 or newer.
Official ID
CVE-2024-50514
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.8.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.15
Fixed in
3.8.16
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.16 or newer.
Official ID
CVE-2024-3866
Report title
Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer
First reported
Sources
This week

Someone who already has an admin account could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.11
Fixed in
3.8.12
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.12 or newer.
Official ID
CVE-2024-43999
Report title
Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (from 3.8.6 up to and including 3.8.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 3.8.6 up to and including 3.8.10
Fixed in
3.8.11
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.11 or newer.
Official ID
CVE-2024-7354
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.8.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.6
Fixed in
3.8.7
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.7 or newer.
Official ID
CVE-2024-39628
Report title
Ninja Forms <= 3.8.6 - Cross-Site Request Forgery
First reported
Sources
This week

Anyone with an account on your site, even a basic one could use it to harm your site (up to and including 3.8.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.4
Fixed in
3.8.5
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.5 or newer.
Official ID
CVE-2024-37934
Report title
Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.8.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.0
Fixed in
3.8.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.1 or newer.
Official ID
CVE-2024-26019
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.8.0) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.0
Fixed in
3.8.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.1 or newer.
Official ID
CVE-2024-29220
Report title
Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.8.0)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.0
Fixed in
3.8.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.1 or newer.
Official ID
CVE-2024-2113
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export
First reported
Sources
This week

Someone with an author account on your site could plant harmful code that runs for your visitors or admins

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.8.0
Fixed in
3.8.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.8.1 or newer.
Official ID
CVE-2024-2108
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting
First reported
Sources
This week

A stranger could read or change the data in your site’s database

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.7.1
Fixed in
3.7.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.7.2 or newer.
Official ID
CVE-2024-0685
Report title
Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.33)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.33
Fixed in
3.6.34
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.34 or newer.
Official ID
CVE-2023-5530
Report title
Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting
First reported
Sources
This week

Someone who already has an admin account could use it to harm your site (up to and including 3.6.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.25
Fixed in
3.6.26
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.26 or newer.
Official ID
CVE-2023-4109
Report title
Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.25
Fixed in
3.6.26
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.26 or newer.
Official ID
CVE-2023-37979
Report title
Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data'
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.6.25)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.25
Fixed in
3.6.26
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.26 or newer.
Official ID
CVE-2023-38386
Report title
Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export
First reported
Sources
This week

Someone could do things on your site they should not be allowed to (up to and including 3.6.25) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.25
Fixed in
3.6.26
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.26 or newer.
Official ID
CVE-2023-38393
Report title
Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export
First reported
Sources
This week

Someone could slow down or crash your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.25
Fixed in
3.6.26
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.26 or newer.
Official ID
CVE-2023-35909
Report title
Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions
First reported
Sources
This week

Someone could read or delete private files on your server

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.24
Fixed in
3.6.25
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.25 or newer.
Official ID
CVE-2023-36505
Report title
Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.21)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.21
Fixed in
3.6.22
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.22 or newer.
Official ID
CVE-2023-1835
Report title
Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title'
First reported
Sources
This week

Someone who already has an admin account could use it to harm your site (up to and including 3.6.12)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.12
Fixed in
3.6.13
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.13 or newer.
Official ID
CVE-2022-2903
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 3.0.34.1; from 3.1 up to and including 3.1.9; from 3.2 up to and including 3.2.27; from 3.3 up to and including 3.3.21.3; from 3.4 up to and including 3.4.34.1; from 3.5 up to and including 3.5.8.3; from 3.6 up to and including 3.6.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.34.1
  • From 3.1 up to and including 3.1.9
  • From 3.2 up to and including 3.2.27
  • From 3.3 up to and including 3.3.21.3
  • From 3.4 up to and including 3.4.34.1
  • From 3.5 up to and including 3.5.8.3
  • From 3.6 up to and including 3.6.10
Fixed in
3.0.34.2, 3.1.10, 3.2.28, 3.3.21.4, 3.4.34.2, 3.5.8.4, 3.6.11
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.11 or newer.
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.9
Fixed in
3.6.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.10 or newer.
Official ID
CVE-2021-25056
Report title
Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.10
Fixed in
3.6.11
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.11 or newer.
Official ID
CVE-2021-25066
Report title
Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.6.9) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.9
Fixed in
3.6.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.10 or newer.
Official ID
CVE-2021-36827
Report title
Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.6.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.9
Fixed in
3.6.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.10 or newer.
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.6.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.6.7
Fixed in
3.6.8
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.8 or newer.
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 3.6.4)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.6.4
Fixed in
3.6.4
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.6.4 or newer.
Official ID
CVE-2021-24889
Report title
Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.5.8.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.5.8.2
Fixed in
3.5.8.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.5.8.2 or newer.
Official ID
CVE-2021-24381
Report title
Ninja Forms <= 3.5.8.1 - Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.5.7)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.7
Fixed in
3.5.8
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.5.8 or newer.
Official ID
CVE-2021-34647
Report title
Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.5.7) (2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.5.7
Fixed in
3.5.8
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.5.8 or newer.
Official ID
CVE-2021-34648
Report title
Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site (before 3.4.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.34
Fixed in
3.4.34
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.34 or newer.
Official ID
CVE-2021-24165
Report title
Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect
First reported
Sources
This week

Someone could use it to harm your site (before 3.4.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.34
Fixed in
3.4.34
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.34 or newer.
Official ID
CVE-2021-24163
Report title
Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
First reported
Sources
This week

Someone could use it to harm your site (before 3.4.34.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.34.1
Fixed in
3.4.34.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.34.1 or newer.
Official ID
CVE-2021-24164
Report title
Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (before 3.4.34)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.34
Fixed in
3.4.34
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.34 or newer.
Official ID
CVE-2021-24166
Report title
Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.4.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.27
Fixed in
3.4.27.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.27.1 or newer.
Official ID
CVE-2020-36175
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field
First reported
Sources
This week

Someone could trick a logged-in admin into changing settings without knowing (up to and including 3.4.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.27
Fixed in
3.4.27.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.27.1 or newer.
Official ID
CVE-2020-36174
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 3.4.27.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.4.27.1
Fixed in
3.4.28
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.28 or newer.
Official ID
CVE-2020-36173
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.4.24.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.24.2
Fixed in
3.4.24.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.24.2 or newer.
Official ID
CVE-2020-12462
Report title
Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.4.23)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.4.23
Fixed in
3.4.23
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.4.23 or newer.
Official ID
CVE-2020-8594
Report title
Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could read or change the data in your site’s database (up to and including 3.3.21.1)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.21.1
Fixed in
3.3.21.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.21.2 or newer.
Official ID
CVE-2019-15025
Report title
Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection
First reported
Sources
This week

Someone could send your visitors from your site to a harmful site (up to and including 3.3.19)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.19
Fixed in
3.3.19.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.19.1 or newer.
Official ID
CVE-2018-19796
Report title
Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.3.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.3.18
Fixed in
3.3.18
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.18 or newer.
Official ID
CVE-2018-19287
Report title
Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.3.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.3.14
Fixed in
3.3.14
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.14 or newer.
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.3.13)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.13
Fixed in
3.3.14
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.14 or newer.
Official ID
CVE-2018-16308
Report title
Ninja Forms Contact Form <= 3.3.13 - CSV Injection
First reported
Sources
This week

Someone could use it to harm your site (up to and including 3.3.8)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.3.8
Fixed in
3.3.9
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.3.9 or newer.
Official ID
CVE-2018-20981
Report title
Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests
First reported
Sources
This week

Someone could use it to harm your site (before 3.2.15)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.15
Fixed in
3.2.15
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.2.15 or newer.
Official ID
CVE-2018-20980
Report title
Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 3.2.14)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.2.14
Fixed in
3.2.14
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.2.14 or newer.
Official ID
CVE-2018-7280
Report title
Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting
First reported
Sources
This week

Someone could run their own code on your site and take it over (up to and including 3.0.31)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 3.0.31
Fixed in
3.0.32
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.0.32 or newer.
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection
First reported
Sources
This week

Someone could use it to harm your site (before 3.0.31)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 3.0.31
Fixed in
3.0.31
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 3.0.31 or newer.
Official ID
CVE-2017-18574
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection
First reported
Sources
This week

Someone could read or change the data in your site’s database (before 2.9.55.2)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.55.2
Fixed in
2.9.55.2
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.55.2 or newer.
Report title
Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.52)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.52
Fixed in
2.9.52
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.52 or newer.
Report title
Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could in some setups, take over your site

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.9.36 up to and including 2.9.42
Fixed in
2.9.42.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.42.1 or newer.
Official ID
CVE-2016-1209
Report title
Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection
First reported
Sources
This week

A stranger could run their own code on your site and take it over

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • From 2.9.36 up to and including 2.9.42
Fixed in
2.9.42.1
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.42.1 or newer.
Official ID
CVE-2016-1209
Report title
Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.28)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.28
Fixed in
2.9.29
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.29 or newer.
Report title
Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could use it to harm your site (up to and including 2.9.27)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.27
Fixed in
2.9.28
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.28 or newer.
Report title
Ninja Forms Contact Form <= 2.9.27 - CSV Injection
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.21)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.21
Fixed in
2.9.22
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.22 or newer.
Report title
Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.9.18)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.9.18
Fixed in
2.9.19
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.19 or newer.
Report title
Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.9.11)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.9.11
Fixed in
2.9.11
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.9.11 or newer.
Report title
Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.8.10)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.10
Fixed in
2.8.10
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.8.10 or newer.
Official ID
CVE-2014-9688
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (before 2.8.9)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Before 2.8.9
Fixed in
2.8.9
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.8.9 or newer.
Official ID
CVE-2015-2220
Report title
Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting
First reported
Sources
This week

Someone could plant harmful code that runs for your visitors or admins (up to and including 2.8.6)

A trusted security source confirmed it. If your site has an affected version, fix it this week.

Affected versions
  • Up to and including 2.8.6
Fixed in
2.8.7
What to do
If your site has an affected version, update Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder to version 2.8.7 or newer.
Official ID
CVE-2014-8815
Report title
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting
First reported
Sources

Where this comes from

We collect these reports from public security sources and rewrite them in plain words. Each problem shows its sources and the date we first saw it. This page never says whether your own site is affected: only a check of your site’s versions can tell.

All plugins and themes

Get an email when your site is affected.

Install Watchfox AI once. It checks your plugins and themes against this list every day, for free.

Install Watchfox AI (free)