Vulnerabilities / Ninja Forms
Ninja Forms vulnerabilities
Advisories WPSec published for Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder. Other sources may list more. Its attack surface: Ninja Forms on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-16 | WPSEC-2026-1134 | Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via Merge Tags | High 7.3 | 3.15.6 |
| 2026-10-16 | WPSEC-2026-1133 | Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via Submission 'calculations' Extra Data | High 7.2 | 3.15.6 |
| 2026-10-16 | WPSEC-2026-1132 | Ninja Forms <= 3.15.5 - Reflected Cross-Site Scripting via Query String Merge Tags in HTML Fields | Medium 6.1 | 3.15.6 |
License: CC BY 4.0