Known vulnerabilities in Ninja Forms – The Contact Form Builder That Grows With You
The 100% beginner friendly WordPress form builder. Drag & drop form fields to build beautiful, professional contact forms in minutes.
81Reported vulnerabilities
9.8Highest CVSS score
3.15.0Latest version
600,000+Active installs
What to do now
Update Ninja Forms – The Contact Form Builder That Grows With You to 3.15.2 or later.
81 of these have a fixed version available. Updating resolves them.
Reported vulnerabilities
| CVE | Severity | Exploit probability |
Affected versions | Fixed in | Published |
|---|---|---|---|---|---|
| CVE-2016-1209 | Critical | 61.6% | 2.9.42 and earlier | 2.9.42.1 |
May 14, 2016 |
| CVE-2025-9083 | Critical | 0.5% | Before 3.11.1 | 3.11.1 |
September 18, 2025 |
| CVE-2018-19287 | Medium | 8.9% | Before 3.3.18 | 3.3.18 |
November 15, 2018 |
| CVE-2021-24163 | High | 1.4% | Before 3.4.34 | 3.4.34 |
April 5, 2021 |
| CVE-2018-16308 | High | 1.8% | Before 3.3.14.1 | 3.3.14.1 |
September 1, 2018 |
| CVE-2021-24889 | High | 1.3% | Before 3.6.4 | 3.6.4 |
November 29, 2021 |
| CVE-2022-2903 | High | 1.2% | Before 3.6.13 | 3.6.13 |
September 26, 2022 |
| CVE-2021-34647 | Medium | 1.2% | 3.5.7 and earlier | 3.5.8 |
September 22, 2021 |
| CVE-2021-24165 | Medium | 1.6% | Before 3.4.34 | 3.4.34 |
April 5, 2021 |
| CVE-2018-19796 | Medium | 1.6% | Before 3.3.19.1 | 3.3.19.1 |
December 3, 2018 |
| CVE-2019-15025 | Critical | 1.8% | Before 3.3.21.2 | 3.3.21.2 |
August 14, 2019 |
| CVE-2024-7354 | Medium | 0.7% | 3.8.6 up to (but not including) 3.8.11 | 3.8.11 |
September 2, 2024 |
| CVE-2023-1835 | Medium | 0.9% | Before 3.6.22 | 3.6.22 |
May 15, 2023 |
| CVE-2024-0685 | Critical | 0.8% | 3.7.1 and earlier | 3.7.2 |
February 2, 2024 |
| CVE-2023-37979 | Medium | 9.7% | 3.6.25 and earlier | 3.6.26 |
July 25, 2023 |
| WF-df46b3d5-a433-47b5-99b8-117591f7dd16 | Critical | — | 3.0.34.1 and earlier 3.1 to 3.1.9 (inclusive) 3.2 to 3.2.27 (inclusive) 3.3 to 3.3.21.3 (inclusive) 3.4 to 3.4.34.1 (inclusive) 3.5 to 3.5.8.3 (inclusive) 3.6 to 3.6.10 (inclusive) |
3.0.34.2 |
June 15, 2022 |
| CVE-2020-8594 | Medium | 1.2% | 3.4.22 to 3.4.22 (inclusive) | 3.4.23 |
February 14, 2020 |
| CVE-2018-20981 | Critical | 1.7% | Before 3.3.9 | 3.3.9 |
August 22, 2019 |
| CVE-2026-65048 | Critical | 0.5% | 3.10.4 up to (but not including) 3.14.9 | 3.14.9 |
July 21, 2026 |
| CVE-2021-24166 | Medium | 0.5% | Before 3.4.34 | 3.4.34 |
April 5, 2021 |
| CVE-2025-14072 | Medium | 0.4% | Before 3.13.3 | 3.13.3 |
January 2, 2026 |
| CVE-2015-2220 | Medium | 2.0% | 2.8.8 and earlier | 2.8.9 |
March 5, 2015 |
| CVE-2026-65052 | High | 0.6% | 0 up to (but not including) 3.14.9 | 3.14.9 |
July 21, 2026 |
| CVE-2025-2524 | Medium | 0.3% | Before 3.10.1 | 3.10.1 |
May 19, 2025 |
| CVE-2023-5530 | Medium | 0.6% | Before 3.6.34 | 3.6.34 |
November 6, 2023 |
| CVE-2021-25066 | Medium | 0.6% | Before 3.6.10 | 3.6.10 |
July 4, 2022 |
| CVE-2021-25056 | Medium | 0.6% | Before 3.6.10 | 3.6.10 |
July 4, 2022 |
| CVE-2025-2561 | Medium | 0.2% | Before 3.10.1 | 3.10.1 |
May 19, 2025 |
| CVE-2025-2560 | Medium | 0.2% | Before 3.10.1 | 3.10.1 |
May 19, 2025 |
| WF-488970f0-3120-4f4a-9915-2ae1708bd86a | High | — | 3.6.9 and earlier | 3.6.10 |
June 7, 2022 |
| WF-89a44d42-a110-4f55-ad27-2be4ccb41a16 | High | — | Before 2.9.55.2 | 2.9.55.2 |
August 16, 2016 |
| CVE-2026-65049 | High | 0.4% | 0 up to (but not including) 3.14.9 | 3.14.9 |
July 21, 2026 |
| CVE-2021-34648 | Medium | 0.7% | 3.5.7 and earlier | 3.5.8 |
September 22, 2021 |
| CVE-2021-24164 | Medium | 0.9% | Before 3.4.34.1 | 3.4.34.1 |
April 5, 2021 |
| WF-aa735320-f7fe-4e51-9f9a-f4c8f3ddc2e7 | High | — | Before 3.3.14 | 3.3.14 |
August 27, 2018 |
| WF-39b6a1c7-2f8a-49e9-8807-a53a25524018 | High | — | 2.9.27 and earlier | 2.9.28 |
September 30, 2015 |
| CVE-2014-9688 | High | 2.0% | 2.8.9 and earlier | 2.8.10 |
March 5, 2015 |
| CVE-2018-20980 | High | 1.4% | Before 3.2.15 | 3.2.15 |
August 22, 2019 |
| CVE-2026-1239 | High | 0.5% | 0 to 3.14.1 (inclusive) | 3.14.2 |
July 1, 2026 |
| CVE-2026-2268 | High | 0.3% | 0 to 3.14.0 (inclusive) | 3.14.1 |
February 10, 2026 |
| CVE-2025-11924 | High | 0.4% | Before 3.13.1 | 3.13.1 |
December 17, 2025 |
| CVE-2026-19769 | High | 0.2% | 0 to 3.15.1 (inclusive) | 3.15.2 |
September 5, 2026 |
| CVE-2026-65050 | High | 0.4% | 0 up to (but not including) 3.14.9 | 3.14.9 |
July 21, 2026 |
| WF-7bd89bd9-4f99-4828-bacc-15d2cfe13066 | High | — | 2.9.28 and earlier | 2.9.29 |
December 8, 2015 |
| CVE-2026-65051 | Medium | 0.5% | 0 up to (but not including) 3.14.9 | 3.14.9 |
July 21, 2026 |
| CVE-2023-36505 | Medium | 0.6% | 3.6.24 and earlier | 3.6.25 |
June 22, 2023 |
| CVE-2020-36174 | Medium | 0.6% | Before 3.4.27.1 | 3.4.27.1 |
January 6, 2021 |
| CVE-2026-1307 | Medium | 0.2% | 0 to 3.14.1 (inclusive) | 3.14.2 |
March 28, 2026 |
| CVE-2024-12238 | Medium | 0.5% | Before 3.8.23 | 3.8.23 |
December 29, 2024 |
| CVE-2017-18574 | Medium | 0.9% | Before 3.0.31 | 3.0.31 |
August 22, 2019 |
| CVE-2018-7280 | Medium | 0.8% | Before 3.2.14 | 3.2.14 |
February 21, 2018 |
| CVE-2024-11052 | Medium | 0.3% | Before 3.8.20 | 3.8.20 |
December 12, 2024 |
| CVE-2024-3866 | Medium | 0.3% | Before 3.8.16 | 3.8.16 |
September 25, 2024 |
| CVE-2020-12462 | Medium | 0.5% | Before 3.4.24.2 | 3.4.24.2 |
April 29, 2020 |
| WF-e01532bb-3011-4efe-b072-d0df5708f8e9 | Medium | — | Before 2.9.52 | 2.9.52 |
July 19, 2016 |
| WF-69435cb6-9591-45bb-86e3-eaf1a9bc46f9 | Medium | — | 2.9.18 and earlier | 2.9.19 |
June 5, 2015 |
| WF-dba01dc2-c73b-461a-bcbd-86daa0bf0ad0 | Medium | — | Before 2.9.11 | 2.9.11 |
April 20, 2015 |
| CVE-2014-8815 | Medium | — | 2.8.6 and earlier | 2.8.7 |
November 6, 2014 |
| CVE-2020-36175 | Medium | 1.2% | Before 3.4.27.1 | 3.4.27.1 |
January 6, 2021 |
| CVE-2020-36173 | Medium | 1.1% | Before 3.4.28 | 3.4.28 |
January 6, 2021 |
| CVE-2024-13470 | Medium | 0.3% | Before 3.8.25 | 3.8.25 |
January 30, 2025 |
| CVE-2024-2108 | Medium | 0.3% | Before 3.8.1 | 3.8.1 |
March 29, 2024 |
| CVE-2023-35909 | Medium | 0.8% | Before 3.6.26 | 3.6.26 |
December 7, 2023 |
| CVE-2025-10498 | Medium | 0.2% | Before 3.12.1 | 3.12.1 |
September 27, 2025 |
| CVE-2025-5398 | Medium | 0.2% | Before 3.10.2.2 | 3.10.2.2 |
June 27, 2025 |
| CVE-2023-38386 | Medium | 0.5% | 3.6.25 and earlier | 3.6.26 |
July 25, 2023 |
| WF-cda2465e-b17e-4b5c-ad86-3c3c7a354d03 | Medium | — | 3.6.7 and earlier | 3.6.8 |
March 22, 2022 |
| WF-f3ebaf25-1bd3-4770-b4bd-30de83b31add | Medium | — | 3.0.31 and earlier | 3.0.32 |
April 17, 2017 |
| WF-ee74d229-499e-4f9a-ad7d-c707f6eeac6e | Medium | — | 2.9.21 and earlier | 2.9.22 |
August 4, 2015 |
| CVE-2026-15663 | Medium | 0.3% | 0 to 3.14.9 (inclusive) | 3.14.10 |
July 24, 2026 |
| CVE-2021-36827 | Medium | 0.5% | 3.6.9 and earlier | 3.6.10 |
June 16, 2022 |
| CVE-2024-50515 | Medium | 0.4% | 3.8.17 and earlier | 3.8.18 |
October 28, 2024 |
| CVE-2024-50514 | Medium | 0.4% | 3.8.17 and earlier | 3.8.18 |
October 28, 2024 |
| CVE-2024-43999 | Medium | 0.3% | 3.8.11 and earlier | 3.8.12 |
August 28, 2024 |
| CVE-2024-26019 | Medium | 0.5% | 3.8.0 and earlier | 3.8.1 |
April 8, 2024 |
| CVE-2024-29220 | Medium | 0.5% | 3.8.0 and earlier | 3.8.1 |
April 8, 2024 |
| CVE-2023-38393 | Medium | 0.5% | 3.6.25 and earlier | 3.6.26 |
July 25, 2023 |
| CVE-2025-10499 | Medium | 0.2% | Before 3.12.1 | 3.12.1 |
September 27, 2025 |
| CVE-2024-39628 | Medium | 0.2% | 3.8.6 and earlier | 3.8.7 |
July 24, 2024 |
| CVE-2024-37934 | Medium | 0.5% | 3.8.4 and earlier | 3.8.5 |
July 4, 2024 |
| CVE-2024-2113 | Medium | 0.2% | Before 3.8.1 | 3.8.1 |
March 29, 2024 |