VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 76 known issues Latest disclosed Mar 27, 2026

Ninja Forms – The Contact Form Builder That Grows With You Vulnerabilities

Review known vulnerability records for the WordPress plugin Ninja Forms – The Contact Form Builder That Grows With You (`ninja-forms`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
76
High or Critical
22
Patch Coverage
100%
Last Updated
Apr 13, 2026
Related Security Guides

Use these guides while reviewing Ninja Forms – The Contact Form Builder That Grows With You fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Ninja Forms – The Contact Form Builder That Grows With You remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
61
1. Match the Package
Confirm the installed WordPress plugin slug is ninja-forms before acting on any CVE from this cluster.
2. Sort by Severity
Start with 22 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
76 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2019-15025 Critical
SQL Injection remediation for Ninja Forms – The Contact Form Builder That Grows With You

Affected range: Versions up to 3.3.21.1. Fixed version: 3.3.21.2.

CVE-2016-1209 Critical
Arbitrary File Upload remediation for Ninja Forms – The Contact Form Builder That Grows With You

Affected range: 2.9.36 through 2.9.42. Fixed version: 2.9.42.1.

CVE-2018-20981 Critical
Vulnerability remediation for Ninja Forms – The Contact Form Builder That Grows With You

Affected range: Versions up to 3.3.8. Fixed version: 3.3.9.

CVE-2021-24163 High
Vulnerability remediation for Ninja Forms – The Contact Form Builder That Grows With You

Affected range: Versions before 3.4.34. Fixed version: 3.4.34.

Priority CVE Quick Links

Fast paths into Ninja Forms – The Contact Form Builder That Grows With You CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
64
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2019-15025
Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection
 SQL Injection Versions up to 3.3.21.1 3.3.21.2 CVSS 9.8
CVE-2016-1209
Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload
 Arbitrary File Upload 2.9.36 through 2.9.42 2.9.42.1 CVSS 9.8
CVE-2018-20981
Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data request...
 Vulnerability Versions up to 3.3.8 3.3.9 CVSS 9.1
CVE-2021-24163
Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Cl...
 Vulnerability Versions before 3.4.34 3.4.34 CVSS 8.8
CVE-2020-36174
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 -...
 Cross-Site Request Forgery Versions up to 3.4.27 3.4.27.1 CVSS 8.8
CVE-2018-16308
Ninja Forms Contact Form <= 3.3.13 - CSV Injection
 Vulnerability Versions up to 3.3.13 3.3.14 CVSS 8.6
CVE-2025-9083
Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection
 Vulnerability Versions up to 3.11.0 3.11.1 CVSS 8.1
CVE-2016-1209
Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection
 Vulnerability 2.9.36 through 2.9.42 2.9.42.1 CVSS 8.1
CVE-2019-15025 Critical 3.3.21.2
CVE-2019-15025 Ninja Forms – The Contact Form Builder That Grows With You SQL Injection

Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection

CVE-2016-1209 Critical 2.9.42.1
CVE-2016-1209 Ninja Forms – The Contact Form Builder That Grows With You Arbitrary File Upload

Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload

CVE-2018-20981 Critical 3.3.9
CVE-2018-20981 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests

CVE-2021-24163 High 3.4.34
CVE-2021-24163 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure

CVE-2020-36174 High 3.4.27.1
CVE-2020-36174 Ninja Forms – The Contact Form Builder That Grows With You Cross-Site Request Forgery

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation

CVE-2018-16308 High 3.3.14
CVE-2018-16308 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form <= 3.3.13 - CSV Injection

CVE-2025-9083 High 3.11.1
CVE-2025-9083 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

CVE-2016-1209 High 2.9.42.1
CVE-2016-1209 Ninja Forms – The Contact Form Builder That Grows With You Vulnerability

Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Ninja Forms – The Contact Form Builder That Grows With You so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
76 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
4 critical and 18 high severity findings.
Recent CVEs
CVE-2026-1307, CVE-2026-2268 and CVE-2025-11924
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

CVE-2025-11924 High Patch path listed

CVE-2025-11924: Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to...

Published
Dec 16, 2025
Patch Status
3.13.3
Review CVE-2025-11924 affected versions
Known Vulnerabilities

Reports for Ninja Forms – The Contact Form Builder That Grows With You

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-1307
CVE-2026-1307: Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This make...

Published
Mar 27, 2026
Patched Release
3.14.2
Affected Versions
Versions up to 3.14.1
Next Step
Update to 3.14.2 or newer if supported.
Review CVE-2026-1307 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2026-2268
CVE-2026-2268: Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action

The Ninja Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.0. This is due to the unsafe application of the `ninja_forms_merge_tags` filter to user-supplied input within repeater fields, which allows the resoluti...

Published
Feb 09, 2026
Patched Release
3.14.1
Affected Versions
Versions up to 3.14.0
Next Step
Update to 3.14.1 or newer if supported.
Review CVE-2026-2268 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-11924
CVE-2025-11924: Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views...

Published
Dec 16, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Review CVE-2025-11924 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-14072
CVE-2025-14072: Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /ninja-forms-views/token/refresh function in all versions up to, and including, 3.13.2. This makes it possible...

Published
Dec 12, 2025
Patched Release
3.13.3
Affected Versions
Versions up to 3.13.2
Next Step
Update to 3.13.3 or newer if supported.
Review CVE-2025-14072 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10499
CVE-2025-10499: Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possibl...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Review CVE-2025-10499 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-10498
CVE-2025-10498: Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unau...

Published
Sep 26, 2025
Patched Release
3.12.1
Affected Versions
Versions up to 3.12.0
Next Step
Update to 3.12.1 or newer if supported.
Review CVE-2025-10498 fixed version details Open CVE Reference
Plugin High Patched: Yes CVE-2025-9083
CVE-2025-9083: Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.11.0 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Obje...

Published
Aug 28, 2025
Patched Release
3.11.1
Affected Versions
Versions up to 3.11.0
Next Step
Update to 3.11.1 or newer if supported.
Review CVE-2025-9083 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5398
CVE-2025-5398: Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the t...

Published
Jun 26, 2025
Patched Release
3.10.2.2
Affected Versions
Versions up to 3.10.2.1
Next Step
Update to 3.10.2.2 or newer if supported.
Review CVE-2025-5398 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2560
CVE-2025-2560: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Review CVE-2025-2560 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2524
CVE-2025-2524: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Review CVE-2025-2524 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-2561
CVE-2025-2561: Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.10.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Published
Apr 28, 2025
Patched Release
3.10.1
Affected Versions
Versions up to 3.10.0
Next Step
Update to 3.10.1 or newer if supported.
Review CVE-2025-2561 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-13470
CVE-2024-13470: Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied att...

Published
Jan 29, 2025
Patched Release
3.8.25
Affected Versions
Versions up to 3.8.24
Next Step
Update to 3.8.25 or newer if supported.
Review CVE-2024-13470 fixed version details Open CVE Reference