Plugin Pulse Beta
← Pulse

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

by Kevin Stover · Forms

Also makes 4 other plugins · 510.1K+ installs across the portfolio →

Try it live ↗ wp.org ↗

Free WordPress form builder with calculations, signatures, star ratings, unlimited submissions stored on your site, and an AI form builder.

Try it live opens a temporary test site in your browser, which can take about 20 seconds to load. Plugins that rely on outside services or a full server may not work completely there.

Health

B 84/100

no flags

Active installs

500K+

≈590K estimated

Momentum

-23%

downloads vs prior 30d

Biggest opportunity: Support resolution scores 55/100. Mark more forum threads resolved — the resolved ratio feeds the ranking.

See the detail → Get the free audit
How scoring works →
84 Health · B
Maintenance 100/100
Rating quality 85/100
Support 65/100
Security 75/100

84 health vs 65 average across 2,512 Forms plugins

500K+

Active installs

≈590K estimated

64.5M

Total downloads

since 2011 · 0.8% still active

4.4/5

Rating

1,397 reviews · +0.2/wk

-23%

679.8K

Downloads · 30d

category median +12%

Install conversion

How it's measured →

0.8%

of downloads still active

At least 500K of 64.5M lifetime downloads are still running, below its category: the median Forms plugin keeps 1.2%, across 1,669 plugins.

Downloads count every update, not just first installs, so older and more frequently released plugins read lower. Compare against other Forms plugins, not across the directory. wp.org reports active installs as the bottom of a band, so the real rate is this or higher.

This plugin shipped 35 releases in the last 12 months, and every existing install that updated counted as another download. wp.org publishes no split between first installs and updates, so we show the raw rate rather than guess at one.

Ratings · 1397 reviews

Read on wp.org ↗
5★
1099 4★
67 3★
41 2★
40 1★
150

Details

Version
3.15.7
Last updated
6d ago
Added
2011-12-21 · 14 yrs old
Requires WP
6.9
Tested up to
7.1.4
Requires PHP
7.4
Changelog ↗Support forum ↗Reviews ↗Advanced stats ↗

Recent review vibe

read from the latest 12 reviews to 2026-06-11
Positive PraiseCompatibility

Reviewers keep praising Ninja Forms' fast, hands-on support and steady form-building experience, with a handful of low stars aimed only at the forced rating popup, not the plugin itself.

Directory ranking optimization

How it's scored →

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

91 / 100

Excellent listing optimization

Most to gain: Support resolution

Update recency 100/100

Updated 6 days ago

WP compatibility 100/100

Tested up to WordPress 7.1.4, the current branch or newer

Rating quality 88/100

4.4★ over 1,397 reviews, smoothed to 4.39★

Listing tuning 100/100

5 of 5 tags set · short description in place

Support resolution 55/100

6 of 11 support threads resolved in the last 2 months

To rank higher: Mark more forum threads resolved — the resolved ratio feeds the ranking.

Get the full rank-higher report →

Daily downloads

Since 5 Oct 2022 · 1,489 days · wp.org + Plugin Pulse archive

-23% vs prior 30d
8K1 Nov 2026

30-day downloads

Rolling 30-day volume · peak 1.5M · peaks are release surges

677.2K1 Nov 2026

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Ninja Forms · #114youWPForms · #9Fluent Forms · #81SureForms · #119

Rating trend

Star average over time · dips mark rough releases

4.41 Nov 2026

Health trend

Composite health score, snapshotted daily

841 Nov 2026

Update activity

How busy the existing users are, measured as downloads in the last 30 days for every 1,000 active sites. A spike means a new release everyone's pulling; a long, slow decline means an aging user base that updates less.

1.4K1 Nov 2026

Release cadence

Actively maintained
from wp.org release tags

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

35

releases in the last 12 months

6d ago

latest release · v3.15.7 · 26 Oct 2026

50

tagged releases on record

Recent releases

3.15.7 · 26 Oct 20263.15.6 · 15 Oct 20263.15.5 · 28 Sep 20263.15.4 · 21 Sep 20263.15.3 · 7 Sep 20263.15.2 · 31 Aug 20263.15.1 · 24 Aug 20263.15.0 · 12 Aug 20263.14.12 · 10 Aug 20263.14.11 · 27 Jul 20263.14.10 · 20 Jul 20263.14.9 · 13 Jul 20263.14.8 · 30 Jun 20263.14.7 · 22 Jun 2026

What its installed base runs

via wordpress.org

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

v3.14 60%
v3.6 7.8%
v3.8 7.3%
Older / other versions 25%

Estimated active installs

The public count shows “500K+”. Our estimate pins where the real number sits.

tracked estimate
500K–600K ≈590K

Crossed into this band 28 days ago and a band this size takes about a year or more to cross, so the real count is still just under 600K.

Install history since 1 Oct 2021

500K1 Nov 2026

Recent reviews

All reviews on wp.org ↗
  1. ★★★★★ rmwatts
    5mo ago

    There was a conflict between an older version of htmlpurifier included in the Excel Export plugin and a newer version in CiviCRM on our site that was creating nonstop bug reports. I submitted a ticket and got a very helpful response within a day and within two days the issue was resolved and the plugin is functioning without problem.

    Read on wp.org ↗
  2. ★★★★★ Periklis Kakarakidis
    6mo ago

    Ninja forms seems to have a great UI for the creation of custom Forms and I personally love it!I would recommend it for everyone begginer and advanced wordpress user to try it.

    Read on wp.org ↗
  3. ★★★★★ stargfxllc
    6mo ago

    The Ninja Forms team responds faster than most and actually gets the job done. They’re thorough, hands-on, and help resolve issues quickly. It saves a lot of time compared to the endless back-and-forth you get with other software companies. Instead of sending confusing emails, they jump in and help. Support like that keeps me coming back and confident using Ninja Forms on other websites. Cheers!

    Read on wp.org ↗
  4. ★★★★★ blogginginnovation
    7mo ago

    Don’t like being forced to rate before I even know whether it works

    Read on wp.org ↗
  5. ★★★★★ ju571n3
    7mo ago

    popup always This topic was modified 3 months ago by ju571n3.

    Read on wp.org ↗
  6. ★★★★★ Fred
    7mo ago

    Great plugin, I’ve been using it with great satisfaction for several years now.The support is fantastic; they respond quickly, reliably, and are very competent.Thanks and keep up the good work!

    Read on wp.org ↗
  7. ★★★★★ zonaisgood
    7mo ago

    popup

    Read on wp.org ↗
  8. ★★★★★ bobjgarrett
    7mo ago

    We have been using this for a while and found it to be excellent. Recently had a problem which their support quickly proposed a solution for that related to how another plugin was set up.

    Read on wp.org ↗

Latest updates

via wp.org changelog

Recent releases and news for this plugin

  1. — Version 3.14.10 Bug Fixes: fix anchor tag URLs breaking when merge tags are used as querystrings in HTML fields fix date field required validation not triggering for Date & Time mode fix {other:date} merge tag reporting dates in UTC ins 3.14.10
  2. — Version 3.14.9 Bug Fixes: restore visibility of “Almost there…” heading in new-form drawer add descender allowance for typed signature fonts in PDF Security Enhancements: protect against unauthorized multisite data deletion protect aga 3.14.9
  3. — Version 3.14.8 Bug Fixes: fix merge tag picker falsely triggering for calculation tags with slash in name fix phone field truncating last digit when browser autofill includes country code fix PHP warning for array offset on null in Mod 3.14.8
  4. — Version 3.14.7 Bug Fixes: fix date field “default to current date” displaying wrong date with conditional logic fix date/date-time field value corruption when editing via submissions backend fix checkbox fields not being redacted from 3.14.7
  5. — Version 3.14.6 Bug Fixes: fix PHP warnings when retriggering emails from submissions page fix bulk export returning no results when selecting a single day 3.14.6
  6. — Version 3.14.5 Bug Fixes: fix Rich Text Editor content displaying as raw HTML in submissions modal fix HTML entity decoding in Rich Text Editor fields fix Quill Rich Text Editor inline text alignment not being preserved fix unordered l 3.14.5

Security history

via Wordfence Intelligence

All 94 disclosed vulnerabilities are patched in the current version (3.15.7). Sites still on an older version should update.

  1. Patched Medium · 6.1 Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter ↗
    2026-10-30 CVE-2026-100151 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.5 Patched in 3.15.6
  2. Patched Medium · 6.5 Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag ↗
    2026-10-30 CVE-2026-100155 Improper Control of Generation of Code Affects <= 3.15.5 Patched in 3.15.6
  3. Patched Medium · 5.4 Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name ↗
    2026-10-30 CVE-2026-101326 Improper Control of Generation of Code Affects <= 3.15.5 Patched in 3.15.6
  4. Patched High · 7.2 Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization ↗
    2026-10-30 CVE-2026-109997 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.5 Patched in 3.15.6
  5. Patched High · 7.2 Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-10-19 CVE-2026-110899 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.5 Patched in 3.15.6
  6. Patched High · 7.2 Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission ↗
    2026-10-01 CVE-2026-90438 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.4 Patched in 3.15.5
  7. Patched High · 7.2 Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-30 CVE-2026-102385 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.3 Patched in 3.15.5
  8. Patched High · 7.2 Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-23 CVE-2026-95515 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.3 Patched in 3.15.4
  9. Patched High · 7.2 Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-22 CVE-2026-92438 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.3 Patched in 3.15.4
  10. Patched High · 8.1 Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection ↗
    2026-09-22 CVE-2026-91827 Deserialization of Untrusted Data Affects <= 3.15.3 Patched in 3.15.4
  11. Patched High · 7.2 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting ↗
    2026-09-21 CVE-2026-94504 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.3 Patched in 3.15.4
  12. Patched Medium · 6.6 Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import ↗
    2026-09-08 CVE-2026-11363 Deserialization of Untrusted Data Affects <= 3.14.6 Patched in 3.14.7
  13. Patched High · 7.2 Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key ↗
    2026-09-04 CVE-2026-19769 Improper Neutralization of Input During Web Page Generation Affects <= 3.15.1 Patched in 3.15.2
  14. Patched Medium · 6.5 Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-09-04 CVE-2026-80437 Improper Control of Generation of Code Affects 3.14.10 - 3.15.1 Patched in 3.15.2
  15. Patched Low · 3.1 Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure ↗
    2026-09-02 CVE-2026-80438 Exposure of Sensitive Information to an Unauthorized Actor Affects 3.14.0 - 3.15.1 Patched in 3.15.2
  16. Patched Medium · 5.3 Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-07-27 CVE-2026-15256 Improper Control of Generation of Code Affects <= 3.14.9 Patched in 3.14.10
  17. Patched Medium · 4.9 Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key ↗
    2026-07-23 CVE-2026-15663 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.14.9 Patched in 3.14.10
  18. Patched High · 7.5 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint ↗
    2026-06-30 CVE-2026-1239 Missing Authorization Affects <= 3.14.1 Patched in 3.14.2
  19. Patched Medium · 6.5 Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token ↗
    2026-03-27 CVE-2026-1307 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.14.1 Patched in 3.14.2
  20. Patched High · 7.5 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action ↗
    2026-02-09 CVE-2026-2268 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.14.0 Patched in 3.14.1
  21. Patched High · 7.5 Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token ↗
    2025-12-16 CVE-2025-11924 Authorization Bypass Through User-Controlled Key Affects <= 3.13.2 Patched in 3.13.3
  22. Patched High · 7.5 Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure ↗
    2025-12-12 CVE-2025-14072 Missing Authorization Affects <= 3.13.2 Patched in 3.13.3
  23. Patched Medium · 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update ↗
    2025-09-26 CVE-2025-10499 Cross-Site Request Forgery Affects <= 3.12.0 Patched in 3.12.1
  24. Patched Medium · 4.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion ↗
    2025-09-26 CVE-2025-10498 Cross-Site Request Forgery Affects <= 3.12.0 Patched in 3.12.1
  25. Patched High · 8.1 Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection ↗
    2025-08-28 CVE-2025-9083 Deserialization of Untrusted Data Affects <= 3.11.0 Patched in 3.11.1
  26. Patched Medium · 6.4 Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI ↗
    2025-06-26 CVE-2025-5398 Improper Neutralization of Input During Web Page Generation Affects <= 3.10.2.1 Patched in 3.10.2.2
  27. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2561 Improper Neutralization of Input During Web Page Generation Affects <= 3.10.0 Patched in 3.10.1
  28. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2560 Improper Neutralization of Input During Web Page Generation Affects <= 3.10.0 Patched in 3.10.1
  29. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2025-04-28 CVE-2025-2524 Improper Neutralization of Input During Web Page Generation Affects <= 3.10.0 Patched in 3.10.1
  30. Patched Medium · 6.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2025-01-29 CVE-2024-13470 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.24 Patched in 3.8.25
  31. Patched Medium · 6.3 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2024-12-28 CVE-2024-12238 Improper Control of Generation of Code Affects <= 3.8.22 Patched in 3.8.23
  32. Patched High · 7.2 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations ↗
    2024-12-11 CVE-2024-11052 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.19 Patched in 3.8.20
  33. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-10-28 CVE-2024-50515 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.17 Patched in 3.8.18
  34. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-10-28 CVE-2024-50514 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.17 Patched in 3.8.18
  35. Patched Medium · 4.7 Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer ↗
    2024-09-24 CVE-2024-3866 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.15 Patched in 3.8.16
  36. Patched Medium · 4.4 Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-08-28 CVE-2024-43999 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.11 Patched in 3.8.12
  37. Patched Medium · 6.1 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting ↗
    2024-08-12 CVE-2024-7354 Improper Neutralization of Input During Web Page Generation Affects 3.8.6 - 3.8.10 Patched in 3.8.11
  38. Patched Medium · 4.3 Ninja Forms <= 3.8.6 - Cross-Site Request Forgery ↗
    2024-07-24 CVE-2024-39628 Cross-Site Request Forgery Affects <= 3.8.6 Patched in 3.8.7
  39. Patched Medium · 4.3 Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ↗
    2024-07-04 CVE-2024-37934 Missing Authorization Affects <= 3.8.4 Patched in 3.8.5
  40. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-26019 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.0 Patched in 3.8.1
  41. Patched Medium · 4.4 Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-04-08 CVE-2024-29220 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.0 Patched in 3.8.1
  42. Patched Medium · 4.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export ↗
    2024-03-28 CVE-2024-2113 Cross-Site Request Forgery Affects <= 3.8.0 Patched in 3.8.1
  43. Patched Medium · 4.6 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ↗
    2024-03-28 CVE-2024-2108 Improper Neutralization of Input During Web Page Generation Affects <= 3.8.0 Patched in 3.8.1
  44. Patched Medium · 5.9 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection ↗
    2024-02-01 CVE-2024-0685 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.7.1 Patched in 3.7.2
  45. Patched Medium · 4.4 Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2023-10-16 CVE-2023-5530 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.33 Patched in 3.6.34
  46. Patched Medium · 4.4 Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection ↗
    2023-08-07 CVE-2023-4109 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.25 Patched in 3.6.26
  47. Patched Medium · 6.1 Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data' ↗
    2023-07-25 CVE-2023-37979 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.25 Patched in 3.6.26
  48. Patched Medium · 5.3 Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export ↗
    2023-07-25 CVE-2023-38386 Missing Authorization Affects <= 3.6.25 Patched in 3.6.26
  49. Patched Medium · 4.3 Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export ↗
    2023-07-25 CVE-2023-38393 Missing Authorization Affects <= 3.6.25 Patched in 3.6.26
  50. Patched Medium · 5.3 Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions ↗
    2023-07-07 CVE-2023-35909 Uncontrolled Resource Consumption Affects <= 3.6.25 Patched in 3.6.26
  51. Patched Medium · 6.5 Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion ↗
    2023-06-22 CVE-2023-36505 External Control of File Name or Path Affects <= 3.6.24 Patched in 3.6.25
  52. Patched Medium · 6.1 Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title' ↗
    2023-04-24 CVE-2023-1835 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.21 Patched in 3.6.22
  53. Patched High · 7.2 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection ↗
    2022-09-05 CVE-2022-2903 Deserialization of Untrusted Data Affects <= 3.6.12 Patched in 3.6.13
  54. Patched Critical · 9.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection ↗
    2022-06-15 Improper Control of Generation of Code Affects <= 3.0.34.1 Patched in 3.0.34.2
  55. Patched Medium · 4.8 Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label ↗
    2022-06-13 CVE-2021-25056 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.9 Patched in 3.6.10
  56. Patched Medium · 5.5 Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import ↗
    2022-06-10 CVE-2021-25066 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.10 Patched in 3.6.11
  57. Patched Medium · 5.5 Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label ↗
    2022-06-07 CVE-2021-36827 Improper Neutralization of Input During Web Page Generation Affects <= 3.6.9 Patched in 3.6.10
  58. Patched High · 8.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection ↗
    2022-06-07 Cross-Site Request Forgery Affects <= 3.6.9 Patched in 3.6.10
  59. Patched Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure ↗
    2022-03-22 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.6.7 Patched in 3.6.8
  60. Patched High · 7.2 Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection ↗
    2021-10-26 CVE-2021-24889 Improper Neutralization of Special Elements used in an SQL Command Affects < 3.6.4 Patched in 3.6.4
  61. Patched Medium · 4.8 Ninja Forms <= 3.5.8.1 - Cross-Site Scripting ↗
    2021-09-27 CVE-2021-24381 Improper Neutralization of Input During Web Page Generation Affects < 3.5.8.2 Patched in 3.5.8.2
  62. Patched Medium · 6.5 Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure ↗
    2021-09-22 CVE-2021-34647 Incorrect Authorization Affects <= 3.5.7 Patched in 3.5.8
  63. Patched Medium · 6.4 Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection ↗
    2021-09-22 CVE-2021-34648 Incorrect Authorization Affects <= 3.5.7 Patched in 3.5.8
  64. Patched Medium · 6.1 Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect ↗
    2021-02-16 CVE-2021-24165 URL Redirection to Untrusted Site Affects < 3.4.34 Patched in 3.4.34
  65. Patched High · 8.8 Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure ↗
    2021-02-16 CVE-2021-24163 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.4.34 Patched in 3.4.34
  66. Patched Medium · 4.3 Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure ↗
    2021-02-16 CVE-2021-24164 Exposure of Sensitive Information to an Unauthorized Actor Affects < 3.4.34.1 Patched in 3.4.34.1
  67. Patched Medium · 5.4 Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection ↗
    2021-02-16 CVE-2021-24166 Cross-Site Request Forgery Affects < 3.4.34 Patched in 3.4.34
  68. Patched Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field ↗
    2020-09-22 CVE-2020-36175 Improper Input Validation Affects <= 3.4.27 Patched in 3.4.27.1
  69. Patched High · 8.8 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation ↗
    2020-09-22 CVE-2020-36174 Cross-Site Request Forgery Affects <= 3.4.27 Patched in 3.4.27.1
  70. Patched Medium · 6.5 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting ↗
    2020-09-20 CVE-2020-36173 Improper Neutralization of Input During Web Page Generation Affects <= 3.4.27.1 Patched in 3.4.28
  71. Patched Medium · 6.1 Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting ↗
    2020-04-28 CVE-2020-12462 Cross-Site Request Forgery Affects < 3.4.24.2 Patched in 3.4.24.2
  72. Patched Medium · 6.4 Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting ↗
    2020-02-03 CVE-2020-8594 Improper Neutralization of Input During Web Page Generation Affects < 3.4.23 Patched in 3.4.23
  73. Patched Critical · 9.8 Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection ↗
    2019-01-07 CVE-2019-15025 Improper Neutralization of Special Elements used in an SQL Command Affects <= 3.3.21.1 Patched in 3.3.21.2
  74. Patched Medium · 4.7 Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect ↗
    2018-12-01 CVE-2018-19796 URL Redirection to Untrusted Site Affects <= 3.3.19 Patched in 3.3.19.1
  75. Patched Medium · 6.1 Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter ↗
    2018-11-15 CVE-2018-19287 Improper Neutralization of Input During Web Page Generation Affects < 3.3.18 Patched in 3.3.18
  76. Patched High · 8.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting ↗
    2018-08-27 Improper Neutralization of Input During Web Page Generation Affects < 3.3.14 Patched in 3.3.14
  77. Patched High · 8.6 Ninja Forms Contact Form <= 3.3.13 - CSV Injection ↗
    2018-08-19 CVE-2018-16308 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 3.3.13 Patched in 3.3.14
  78. Patched Critical · 9.1 Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests ↗
    2018-07-06 CVE-2018-20981 Improper Input Validation Affects <= 3.3.8 Patched in 3.3.9
  79. Patched High · 7.5 Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering ↗
    2018-02-26 CVE-2018-20980 Improper Input Validation Affects < 3.2.15 Patched in 3.2.15
  80. Patched Medium · 6.1 Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting ↗
    2018-02-20 CVE-2018-7280 Improper Neutralization of Input During Web Page Generation Affects < 3.2.14 Patched in 3.2.14
  81. Patched Medium · 5.3 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection ↗
    2017-04-17 Improper Control of Generation of Code Affects <= 3.0.31 Patched in 3.0.32
  82. Patched Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection ↗
    2017-03-07 CVE-2017-18574 Improper Input Validation Affects < 3.0.31 Patched in 3.0.31
  83. Patched High · 8.8 Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection ↗
    2016-08-16 Improper Neutralization of Special Elements used in an SQL Command Affects < 2.9.55.2 Patched in 2.9.55.2
  84. Patched Medium · 6.1 Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting ↗
    2016-07-19 Improper Neutralization of Input During Web Page Generation Affects < 2.9.52 Patched in 2.9.52
  85. Patched High · 8.1 Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection ↗
    2016-05-13 CVE-2016-1209 Improper Input Validation Affects 2.9.36 - 2.9.42 Patched in 2.9.42.1
  86. Patched Critical · 9.8 Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload ↗
    2016-05-05 CVE-2016-1209 Unrestricted Upload of File with Dangerous Type Affects 2.9.36 - 2.9.42 Patched in 2.9.42.1
  87. Patched High · 7.2 Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting ↗
    2015-12-08 Improper Neutralization of Input During Web Page Generation Affects <= 2.9.28 Patched in 2.9.29
  88. Patched High · 8.4 Ninja Forms Contact Form <= 2.9.27 - CSV Injection ↗
    2015-09-30 Improper Neutralization of Special Elements in Output Used by a Downstream Component Affects <= 2.9.27 Patched in 2.9.28
  89. Patched Medium · 5.4 Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting ↗
    2015-08-04 Improper Neutralization of Input During Web Page Generation Affects <= 2.9.21 Patched in 2.9.22
  90. Patched Medium · 6.1 Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting ↗
    2015-06-05 Improper Neutralization of Input During Web Page Generation Affects <= 2.9.18 Patched in 2.9.19
  91. Patched Medium · 6.1 Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting ↗
    2015-04-20 Improper Neutralization of Input During Web Page Generation Affects < 2.9.11 Patched in 2.9.11
  92. Patched Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting ↗
    2014-12-02 CVE-2014-9688 Improper Neutralization of Input During Web Page Generation Affects < 2.8.10 Patched in 2.8.10
  93. Patched High · 7.2 Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting ↗
    2014-11-20 CVE-2015-2220 Improper Neutralization of Input During Web Page Generation Affects < 2.8.9 Patched in 2.8.9
  94. Patched Medium · 6.1 Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting ↗
    2014-11-06 CVE-2014-8815 Improper Neutralization of Input During Web Page Generation Affects <= 2.8.6 Patched in 2.8.7

Vulnerability records provided by Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. License and terms.

CVE records: Copyright 1999-2026 The MITRE Corporation. CVE terms of use.

Behavioral tests

via WP Hive

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

✓ Low memory footprint
✓ Low page-speed impact
✓ Runs on latest PHP + WP
✓ No PHP errors
✓ No JS errors
✓ Activates cleanly
✓ No resource errors
✓ No external HTTP errors
✓ Optimized database use
✓ Frequently updated

Languages

via translate.wordpress.org

Translated into 120 languages, 29 at 90% or more

Arabic 100%
Basque 100%
Dutch 100%
Dutch (Belgium) 100%
Dutch (Formal) 100%
English (UK) 100%
Esperanto 100%
French (France) 100%
Galician 100%
German 100%
German (Formal) 100%
German (Switzerland) 100%
German (Switzerland) Informal 100%
Korean 100%
Lao 100%
Persian 100%
Polish 100%
Serbian 100%
Spanish (Chile) 100%
Spanish (Spain) 100%
Spanish (Costa Rica) 99%
Czech 98%
Spanish (Venezuela) 95%
Swedish 95%

Plus 96 more locales with partial translations.

AI assistants

How it's measured →

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Premium

Share of voice

How often each assistant names Ninja Forms when asked about these topics, where it comes in the answer, and how that compares with its wp.org search position. Latest run 1 Nov 2026.

Assistants
ChatGPT, Claude
Topics tracked
Forms, Contact form, AI, AI agents
Get early access to Premium →

Readme readiness

6 of 8 pass · checked 1 Nov 2026

Can an assistant quote this readme? Eight deterministic checks over the wp.org listing, no model involved.

  • ! Says what it does Short description names no action; say what the plugin does for the site.
  • ✓ Has a FAQ 14 questions in the FAQ.
  • ✓ FAQ asks real questions 14 of 14 read like questions a user would type.
  • ! Names who it is for One audience phrase ("built for"); say who the plugin is for and what they use it for.
  • ✓ Names what it works with Mentions WPForms, Ninja Forms, Mailchimp, ConvertKit and 13 more.
  • ✓ Headings and lists 13 headings and 7 lists.
  • ✓ Enough to quote 8,484 characters of description.
  • ✓ Tags match the text 3 of 5 tags appear in the text; "Calculator form", "lead form" do not.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

  1. 2026-10-04 600K+ → 500K+ down after 10 days in tier
  2. 2026-09-24 500K+ → 600K+ up after 2 days in tier
  3. 2026-09-22 600K+ → 500K+ down after 402 days in tier
  4. 2025-08-16 700K+ → 600K+ down after 4 days in tier
  5. 2025-08-12 600K+ → 700K+ up after 3 days in tier
  6. 2025-08-09 700K+ → 600K+ down after 1 days in tier
  7. 2025-08-08 600K+ → 700K+ up after 3 days in tier
  8. 2025-08-05 700K+ → 600K+ down after 295 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder into a readme, a review or a deck. It updates itself.

<iframe src="https://plugins.wpmayor.com/embed/ninja-forms" width="480" height="300" style="border:0" loading="lazy" title="Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder — Plugin Pulse"></iframe>
Preview card ↗

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder: 500K+ active installs, 4.4★ (1,397 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/ninja-forms

Spotted a number that looks wrong? Report a data issue and we'll check it against the source.