Ninja Forms – The Contact Form Builder That Grows With You

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

Reviewers keep praising Ninja Forms' fast, hands-on support and steady form-building experience, with a handful of low stars aimed only at the forced rating popup, not the plugin itself.

1. ★★★★★ rmwatts

   3mo ago

   There was a conflict between an older version of htmlpurifier included in the Excel Export plugin and a newer version in CiviCRM on our site that was creating nonstop bug reports. I submitted a ticket and got a very helpful response within a day and within two days the issue was resolved and the plugin is functioning without problem.

   Read on wp.org ↗
2. ★★★★★ Periklis Kakarakidis

   4mo ago

   Ninja forms seems to have a great UI for the creation of custom Forms and I personally love it!I would recommend it for everyone begginer and advanced wordpress user to try it.

   Read on wp.org ↗
3. ★★★★★ stargfxllc

   4mo ago

   The Ninja Forms team responds faster than most and actually gets the job done. They’re thorough, hands-on, and help resolve issues quickly. It saves a lot of time compared to the endless back-and-forth you get with other software companies. Instead of sending confusing emails, they jump in and help. Support like that keeps me coming back and confident using Ninja Forms on other websites. Cheers!

   Read on wp.org ↗
4. ★★★★★ blogginginnovation

   4mo ago

   Don’t like being forced to rate before I even know whether it works

   Read on wp.org ↗
5. ★★★★★ ju571n3

   4mo ago

   popup always This topic was modified 3 months ago by ju571n3.

   Read on wp.org ↗
6. ★★★★★ Fred

   5mo ago

   Great plugin, I’ve been using it with great satisfaction for several years now.The support is fantastic; they respond quickly, reliably, and are very competent.Thanks and keep up the good work!

   Read on wp.org ↗
7. ★★★★★ zonaisgood

   5mo ago

   popup

   Read on wp.org ↗
8. ★★★★★ bobjgarrett

   5mo ago

   We have been using this for a while and found it to be excellent. Recently had a problem which their support quickly proposed a solution for that related to how another plugin was set up.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 3.14.10 Bug Fixes: fix anchor tag URLs breaking when merge tags are used as querystrings in HTML fields fix date field required validation not triggering for Date & Time mode fix {other:date} merge tag reporting dates in UTC ins 3.14.10
2. — Version 3.14.9 Bug Fixes: restore visibility of “Almost there…” heading in new-form drawer add descender allowance for typed signature fonts in PDF Security Enhancements: protect against unauthorized multisite data deletion protect aga 3.14.9
3. — Version 3.14.8 Bug Fixes: fix merge tag picker falsely triggering for calculation tags with slash in name fix phone field truncating last digit when browser autofill includes country code fix PHP warning for array offset on null in Mod 3.14.8
4. — Version 3.14.7 Bug Fixes: fix date field “default to current date” displaying wrong date with conditional logic fix date/date-time field value corruption when editing via submissions backend fix checkbox fields not being redacted from 3.14.7
5. — Version 3.14.6 Bug Fixes: fix PHP warnings when retriggering emails from submissions page fix bulk export returning no results when selecting a single day 3.14.6
6. — Version 3.14.5 Bug Fixes: fix Rich Text Editor content displaying as raw HTML in submissions modal fix HTML entity decoding in Rich Text Editor fields fix Quill Rich Text Editor inline text alignment not being preserved fix unordered l 3.14.5

78 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.9 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key ↗
   2026-07-23 CVE-2026-15663 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.14.9 Patched in 3.14.10
2. High · 7.5 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint ↗
   2026-06-30 CVE-2026-1239 Missing Authorization Affects <= 3.14.1 Patched in 3.14.2
3. Medium · 6.5 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token ↗
   2026-03-27 CVE-2026-1307 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.14.1 Patched in 3.14.2
4. High · 7.5 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action ↗
   2026-02-09 CVE-2026-2268 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.14.0 Patched in 3.14.1
5. High · 7.5 Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token ↗
   2025-12-16 CVE-2025-11924 Authorization Bypass Through User-Controlled Key Affects <= 3.13.2 Patched in 3.13.3
6. High · 7.5 Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure ↗
   2025-12-12 CVE-2025-14072 Missing Authorization Affects <= 3.13.2 Patched in 3.13.3
7. Medium · 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update ↗
   2025-09-26 CVE-2025-10499 Cross-Site Request Forgery (CSRF) Affects <= 3.12.0 Patched in 3.12.1
8. Medium · 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion ↗
   2025-09-26 CVE-2025-10498 Cross-Site Request Forgery (CSRF) Affects <= 3.12.0 Patched in 3.12.1
9. High · 8.1 Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection ↗
   2025-08-28 CVE-2025-9083 Deserialization of Untrusted Data Affects <= 3.11.0 Patched in 3.11.1
10. Medium · 6.4 Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI ↗
    2025-06-26 CVE-2025-5398 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.10.2.1 Patched in 3.10.2.2
11. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2561 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.10.0 Patched in 3.10.1
12. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2560 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.10.0 Patched in 3.10.1
13. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2524 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.10.0 Patched in 3.10.1
14. Medium · 6.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2025-01-29 CVE-2024-13470 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.24 Patched in 3.8.25
15. Medium · 6.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2024-12-28 CVE-2024-12238 Improper Control of Generation of Code ('Code Injection') Affects <= 3.8.22 Patched in 3.8.23
16. High · 7.2 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations ↗
    2024-12-11 CVE-2024-11052 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.19 Patched in 3.8.20
17. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-10-28 CVE-2024-50515 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.17 Patched in 3.8.18
18. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-10-28 CVE-2024-50514 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.17 Patched in 3.8.18
19. Medium · 4.7 Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer ↗
    2024-09-24 CVE-2024-3866 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.15 Patched in 3.8.16
20. Medium · 4.4 Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-08-28 CVE-2024-43999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.11 Patched in 3.8.12
21. Medium · 6.1 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting ↗
    2024-08-12 CVE-2024-7354 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects 3.8.6 - 3.8.10 Patched in 3.8.11
22. Medium · 4.3 Ninja Forms <= 3.8.6 - Cross-Site Request Forgery ↗
    2024-07-24 CVE-2024-39628 Cross-Site Request Forgery (CSRF) Affects <= 3.8.6 Patched in 3.8.7
23. Medium · 4.3 Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2024-07-04 CVE-2024-37934 Missing Authorization Affects <= 3.8.4 Patched in 3.8.5
24. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-26019 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.0 Patched in 3.8.1
25. Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-29220 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.0 Patched in 3.8.1
26. Medium · 4.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export ↗
    2024-03-28 CVE-2024-2113 Cross-Site Request Forgery (CSRF) Affects <= 3.8.0 Patched in 3.8.1
27. Medium · 4.6 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2024-03-28 CVE-2024-2108 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.0 Patched in 3.8.1
28. Medium · 5.9 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection ↗
    2024-02-01 CVE-2024-0685 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.7.1 Patched in 3.7.2
29. Medium · 4.4 Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-10-16 CVE-2023-5530 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.33 Patched in 3.6.34
30. Medium · 4.4 Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection ↗
    2023-08-07 CVE-2023-4109 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.25 Patched in 3.6.26
31. Medium · 6.1 Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data' ↗
    2023-07-25 CVE-2023-37979 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.25 Patched in 3.6.26
32. Medium · 5.3 Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export ↗
    2023-07-25 CVE-2023-38386 Missing Authorization Affects <= 3.6.25 Patched in 3.6.26
33. Medium · 4.3 Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export ↗
    2023-07-25 CVE-2023-38393 Missing Authorization Affects <= 3.6.25 Patched in 3.6.26
34. Medium · 5.3 Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions ↗
    2023-07-07 CVE-2023-35909 Uncontrolled Resource Consumption Affects <= 3.6.25 Patched in 3.6.26
35. Medium · 6.5 Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion ↗
    2023-06-22 CVE-2023-36505 External Control of File Name or Path Affects <= 3.6.24 Patched in 3.6.25
36. Medium · 6.1 Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title' ↗
    2023-04-24 CVE-2023-1835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.21 Patched in 3.6.22
37. High · 7.2 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection ↗
    2022-09-05 CVE-2022-2903 Deserialization of Untrusted Data Affects <= 3.6.12 Patched in 3.6.13
38. Critical · 9.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection ↗
    2022-06-15 Improper Control of Generation of Code ('Code Injection') Affects <= 3.0.34.1 Patched in 3.0.34.2
39. Medium · 4.8 Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label ↗
    2022-06-13 CVE-2021-25056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.9 Patched in 3.6.10
40. Medium · 5.5 Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import ↗
    2022-06-10 CVE-2021-25066 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.10 Patched in 3.6.11
41. Medium · 5.5 Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label ↗
    2022-06-07 CVE-2021-36827 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.6.9 Patched in 3.6.10
42. High · 8.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection ↗
    2022-06-07 Cross-Site Request Forgery (CSRF) Affects <= 3.6.9 Patched in 3.6.10
43. Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure ↗
    2022-03-22 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.6.7 Patched in 3.6.8
44. High · 7.2 Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection ↗
    2021-10-26 CVE-2021-24889 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 3.6.4 Patched in 3.6.4
45. Medium · 4.8 Ninja Forms <= 3.5.8.1 - Cross-Site Scripting ↗
    2021-09-27 CVE-2021-24381 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.5.8.2 Patched in 3.5.8.2
46. Medium · 6.5 Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure ↗
    2021-09-22 CVE-2021-34647 Incorrect Authorization Affects <= 3.5.7 Patched in 3.5.8
47. Medium · 6.4 Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection ↗
    2021-09-22 CVE-2021-34648 Incorrect Authorization Affects <= 3.5.7 Patched in 3.5.8
48. Medium · 6.1 Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect ↗
    2021-02-16 CVE-2021-24165 URL Redirection to Untrusted Site ('Open Redirect') Affects < 3.4.34 Patched in 3.4.34
49. High · 8.8 Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure ↗
    2021-02-16 CVE-2021-24163 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.4.34 Patched in 3.4.34
50. Medium · 4.3 Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure ↗
    2021-02-16 CVE-2021-24164 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.4.34.1 Patched in 3.4.34.1
51. Medium · 5.4 Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection ↗
    2021-02-16 CVE-2021-24166 Cross-Site Request Forgery (CSRF) Affects < 3.4.34 Patched in 3.4.34
52. Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field ↗
    2020-09-22 CVE-2020-36175 Improper Input Validation Affects <= 3.4.27 Patched in 3.4.27.1
53. High · 8.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation ↗
    2020-09-22 CVE-2020-36174 Cross-Site Request Forgery (CSRF) Affects <= 3.4.27 Patched in 3.4.27.1
54. Medium · 6.5 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting ↗
    2020-09-20 CVE-2020-36173 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.4.27.1 Patched in 3.4.28
55. Medium · 6.1 Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting ↗
    2020-04-28 CVE-2020-12462 Cross-Site Request Forgery (CSRF) Affects < 3.4.24.2 Patched in 3.4.24.2
56. Medium · 6.4 Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting ↗
    2020-02-03 CVE-2020-8594 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.4.23 Patched in 3.4.23
57. Critical · 9.8 Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection ↗
    2019-01-07 CVE-2019-15025 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.3.21.1 Patched in 3.3.21.2
58. Medium · 4.7 Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect ↗
    2018-12-01 CVE-2018-19796 URL Redirection to Untrusted Site ('Open Redirect') Affects <= 3.3.19 Patched in 3.3.19.1
59. Medium · 6.1 Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter ↗
    2018-11-15 CVE-2018-19287 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.3.18 Patched in 3.3.18
60. High · 8.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting ↗
    2018-08-27 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.3.14 Patched in 3.3.14
61. High · 8.6 Ninja Forms Contact Form <= 3.3.13 - CSV Injection ↗
    2018-08-19 CVE-2018-16308 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 3.3.13 Patched in 3.3.14
62. Critical · 9.1 Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests ↗
    2018-07-06 CVE-2018-20981 Improper Input Validation Affects <= 3.3.8 Patched in 3.3.9
63. High · 7.5 Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering ↗
    2018-02-26 CVE-2018-20980 Improper Input Validation Affects < 3.2.15 Patched in 3.2.15
64. Medium · 6.1 Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting ↗
    2018-02-20 CVE-2018-7280 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.2.14 Patched in 3.2.14
65. Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection ↗
    2017-04-17 Improper Control of Generation of Code ('Code Injection') Affects <= 3.0.31 Patched in 3.0.32
66. Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection ↗
    2017-03-07 CVE-2017-18574 Improper Input Validation Affects < 3.0.31 Patched in 3.0.31
67. High · 8.8 Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection ↗
    2016-08-16 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects < 2.9.55.2 Patched in 2.9.55.2
68. Medium · 6.1 Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting ↗
    2016-07-19 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.9.52 Patched in 2.9.52
69. High · 8.1 Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection ↗
    2016-05-13 CVE-2016-1209 Improper Input Validation Affects 2.9.36 - 2.9.42 Patched in 2.9.42.1
70. Critical · 9.8 Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload ↗
    2016-05-05 CVE-2016-1209 Unrestricted Upload of File with Dangerous Type Affects 2.9.36 - 2.9.42 Patched in 2.9.42.1
71. High · 7.2 Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting ↗
    2015-12-08 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.28 Patched in 2.9.29
72. High · 8.4 Ninja Forms Contact Form <= 2.9.27 - CSV Injection ↗
    2015-09-30 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affects <= 2.9.27 Patched in 2.9.28
73. Medium · 5.4 Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting ↗
    2015-08-04 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.21 Patched in 2.9.22
74. Medium · 6.1 Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting ↗
    2015-06-05 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.9.18 Patched in 2.9.19
75. Medium · 6.1 Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.9.11 Patched in 2.9.11
76. Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting ↗
    2014-12-02 CVE-2014-9688 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.8.10 Patched in 2.8.10
77. High · 7.2 Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting ↗
    2014-11-20 CVE-2015-2220 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 2.8.9 Patched in 2.8.9
78. Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting ↗
    2014-11-06 CVE-2014-8815 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.6 Patched in 2.8.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 120 languages, 27 at 90% or more

Plus 96 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-08-16 700K+ → 600K+ down after 4 days in tier
2. 2025-08-12 600K+ → 700K+ up after 3 days in tier
3. 2025-08-09 700K+ → 600K+ down after 1 days in tier
4. 2025-08-08 600K+ → 700K+ up after 3 days in tier
5. 2025-08-05 700K+ → 600K+ down after 295 days in tier
6. 2024-10-14 800K+ → 700K+ down after 445 days in tier
7. 2023-07-27 900K+ → 800K+ down after 2 days in tier
8. 2023-07-25 800K+ → 900K+ up after 1 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 3 shared tags A
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 3 shared tags A
• SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 500K+ installs · 4.8★ · 3 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 3 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 3 shared tags A
• JetFormBuilder — Dynamic Blocks Form Builder 80K+ installs · 4.1★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Ninja Forms – The Contact Form Builder That Grows With You into a readme, a review or a deck. It updates itself.

Ninja Forms – The Contact Form Builder That Grows With You: 600K+ active installs, 4.4★ (1,395 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/ninja-forms