Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

89 Quality Score

Active Installs

26/30

With 600,000 active installs, Ninja Forms is widely used but trails top competitors like Contact Form 7 at 10 million and WPForms at 5 million.

Update Freshness

25/25

It was updated within the past day relative to the data snapshot and requires only WP 6.8 and PHP 7.4, scoring a perfect 100 on the maintenance signal.

User Rating

13/15

Users rate it 88 out of 100 across 1,394 reviews, which is solid but slightly below WPForms and Forminator in the same space.

Support Health

10/15

Only 6 of 9 tracked support threads are resolved (66.7%), yielding a low support health score of 50 and indicating inconsistent response performance.

WP Compatibility

15/15

Compatibility is perfect at 100, confirmed against the latest WordPress release tested by the developer.

Scores higher than 98% of indexed plugins

About

Free WordPress form builder with calculations, signatures, star ratings, unlimited submissions stored on your site, and an AI form builder.

Active Installs 500k+

Rating ★★★★ 4.4/5

Last Updated 2026-09-21 2:09pm GMT

Requires WordPress 6.9+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

84 known vulnerabilities, all patched

4 Critical 21 High 58 Medium 1 Low

Most recent: September 21, 2026

View details ▸

Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting High

September 21, 2026 Patched in ["3.15.4"] CVE-2026-94504

Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import Medium

September 8, 2026 Patched in ["3.14.7"] CVE-2026-11363

Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key High

September 4, 2026 Patched in ["3.15.2"] CVE-2026-19769

Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution Medium

September 4, 2026 Patched in ["3.15.2"] CVE-2026-80437

Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure Low

September 2, 2026 Patched in ["3.15.2"] CVE-2026-80438

Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution Medium

July 27, 2026 Patched in ["3.14.10"] CVE-2026-15256

Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key Medium

July 23, 2026 Patched in ["3.14.10"] CVE-2026-15663

Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint High

June 30, 2026 Patched in ["3.14.2"] CVE-2026-1239

Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token Medium

March 27, 2026 Patched in ["3.14.2"] CVE-2026-1307

Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action High

February 9, 2026 Patched in ["3.14.1"] CVE-2026-2268

Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token High

December 16, 2025 Patched in ["3.13.3"] CVE-2025-11924

Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure High

December 12, 2025 Patched in ["3.13.3"] CVE-2025-14072

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update Medium

September 26, 2025 Patched in ["3.12.1"] CVE-2025-10499

Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion Medium

September 26, 2025 Patched in ["3.12.1"] CVE-2025-10498

Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection High

August 28, 2025 Patched in ["3.11.1"] CVE-2025-9083

Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI Medium

June 26, 2025 Patched in ["3.10.2.2"] CVE-2025-5398

Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 28, 2025 Patched in ["3.10.1"] CVE-2025-2561

Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 28, 2025 Patched in ["3.10.1"] CVE-2025-2560

Ninja Forms – The Contact Form Builder That Grows With You <= 3.10.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 28, 2025 Patched in ["3.10.1"] CVE-2025-2524

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium

January 29, 2025 Patched in ["3.8.25"] CVE-2024-13470

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Medium

December 28, 2024 Patched in ["3.8.23"] CVE-2024-12238

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.19 - Unauthenticated Stored Cross-Site Scripting via Form Calculations High

December 11, 2024 Patched in ["3.8.20"] CVE-2024-11052

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

October 28, 2024 Patched in ["3.8.18"] CVE-2024-50515

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.17 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

October 28, 2024 Patched in ["3.8.18"] CVE-2024-50514

Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer Medium

September 24, 2024 Patched in ["3.8.16"] CVE-2024-3866

Ninja Forms <= 3.8.11 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

August 28, 2024 Patched in ["3.8.12"] CVE-2024-43999

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.10 - Reflected Cross-Site Scripting Medium

August 12, 2024 Patched in ["3.8.11"] CVE-2024-7354

Ninja Forms <= 3.8.6 - Cross-Site Request Forgery Medium

July 24, 2024 Patched in ["3.8.7"] CVE-2024-39628

Ninja Forms <= 3.8.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution Medium

July 4, 2024 Patched in ["3.8.5"] CVE-2024-37934

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 8, 2024 Patched in ["3.8.1"] CVE-2024-26019

Ninja Forms – The Contact Form Builder That Grows With You <= 3.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

April 8, 2024 Patched in ["3.8.1"] CVE-2024-29220

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export Medium

March 28, 2024 Patched in ["3.8.1"] CVE-2024-2113

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting Medium

March 28, 2024 Patched in ["3.8.1"] CVE-2024-2108

Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection Medium

February 1, 2024 Patched in ["3.7.2"] CVE-2024-0685

Ninja Forms Contact Form <= 3.6.33 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

October 16, 2023 Patched in ["3.6.34"] CVE-2023-5530

Ninja Forms <= 3.6.25 - Authenticated (Administrator+) Stored HTML Injection Medium

August 7, 2023 Patched in ["3.6.26"] CVE-2023-4109

Ninja Forms <= 3.6.25 - Reflected Cross-Site Scripting via 'data' Medium

July 25, 2023 Patched in ["3.6.26"] CVE-2023-37979

Ninja Forms <= 3.6.25 - Missing Authorization to Contributor+ Form Submission Export Medium

July 25, 2023 Patched in ["3.6.26"] CVE-2023-38386

Ninja Forms <= 3.6.25 - Missing Authorization to Form Submission Export Medium

July 25, 2023 Patched in ["3.6.26"] CVE-2023-38393

Ninja Forms <= 3.6.25 - Denial of Service via Large Form Submissions Medium

July 7, 2023 Patched in ["3.6.26"] CVE-2023-35909

Ninja Forms <= 3.6.24 - Authenticated (Admin+) Arbitrary File Deletion Medium

June 22, 2023 Patched in ["3.6.25"] CVE-2023-36505

Ninja Forms Contact Form <= 3.6.21 - Reflected Cross-Site Scripting via 'title' Medium

April 24, 2023 Patched in ["3.6.22"] CVE-2023-1835

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection High

September 5, 2022 Patched in ["3.6.13"] CVE-2022-2903

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.10 - Code Injection Critical

June 15, 2022 Patched in ["3.0.34.2","3.1.10","3.2.28","3.3.21.4","3.4.34.2","3.5.8.4","3.6.11"]

Ninja Forms Contact Form <= 3.6.9 - Cross-Site Scripting via field label Medium

June 13, 2022 Patched in ["3.6.10"] CVE-2021-25056

Ninja Ninja Forms Contact Form <= 3.6.10 - Authenticated (Admin+) Stored Cross-Site Scripting via import Medium

June 10, 2022 Patched in ["3.6.11"] CVE-2021-25066

Ninja Forms Contact Form <= 3.6.9 - Authenticated (Admin+) Cross-Site Scripting via label Medium

June 7, 2022 Patched in ["3.6.10"] CVE-2021-36827

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.9 - Cross-Site Request Forgery to Field Import and PHP Object Injection High

June 7, 2022 Patched in ["3.6.10"]

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.7 - Email Address Disclosure Medium

March 22, 2022 Patched in ["3.6.8"]

Ninja Forms Contact Form <= 3.6.3 - Authenticated SQL Injection High

October 26, 2021 Patched in ["3.6.4"] CVE-2021-24889

Ninja Forms <= 3.5.8.1 - Cross-Site Scripting Medium

September 27, 2021 Patched in ["3.5.8.2"] CVE-2021-24381

Ninja Forms <= 3.5.7 - Unprotected REST-API to Sensitive Information Disclosure Medium

September 22, 2021 Patched in ["3.5.8"] CVE-2021-34647

Ninja Forms <= 3.5.7 - Unprotected REST-API to Email Injection Medium

September 22, 2021 Patched in ["3.5.8"] CVE-2021-34648

Ninja Forms Contact Form <= 3.4.33 - Administrator Open Redirect Medium

February 16, 2021 Patched in ["3.4.34"] CVE-2021-24165

Ninja Forms Contact Form <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure High

February 16, 2021 Patched in ["3.4.34"] CVE-2021-24163

Ninja Forms <= 3.4.34 - Authenticated OAuth Connection Key Disclosure Medium

February 16, 2021 Patched in ["3.4.34.1"] CVE-2021-24164

Ninja Forms Contact Form <= 3.4.33 - Cross-Site Request Forgery to OAuth Service Disconnection Medium

February 16, 2021 Patched in ["3.4.34"] CVE-2021-24166

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Validation Bypass via Email Field Medium

September 22, 2020 Patched in ["3.4.27.1"] CVE-2020-36175

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27 - Cross-Site Request Forgery to Plugin Installation High

September 22, 2020 Patched in ["3.4.27.1"] CVE-2020-36174

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.4.27.1 - Stored Cross-Site Scripting Medium

September 20, 2020 Patched in ["3.4.28"] CVE-2020-36173

Ninja Forms Contact Form <= 3.4.24.1 - Cross-Site Request Forgery leading to Stored Cross-Site Scripting Medium

April 28, 2020 Patched in ["3.4.24.2"] CVE-2020-12462

Ninja Forms Contact Form <= 3.4.22 - Stored Cross-Site Scripting Medium

February 3, 2020 Patched in ["3.4.23"] CVE-2020-8594

Ninja Forms Contact Form <= 3.3.21.1 - SQL Injection Critical

January 7, 2019 Patched in ["3.3.21.2"] CVE-2019-15025

Ninja Forms Contact Form <= 3.3.19 - Authenticated Open Redirect Medium

December 1, 2018 Patched in ["3.3.19.1"] CVE-2018-19796

Ninja Forms Contact Form <= 3.3.17 - Cross-Site Scripting via begin_date, end_date, or form_id Parameter Medium

November 15, 2018 Patched in ["3.3.18"] CVE-2018-19287

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.3.13 - Cross-Site Scripting High

August 27, 2018 Patched in ["3.3.14"]

Ninja Forms Contact Form <= 3.3.13 - CSV Injection High

August 19, 2018 Patched in ["3.3.14"] CVE-2018-16308

Ninja Forms <= 3.3.8 - Insufficient Restrictions during Export Personal Data requests Critical

July 6, 2018 Patched in ["3.3.9"] CVE-2018-20981

Ninja Forms Contact Form <= 3.2.14 - Parameter Tampering High

February 26, 2018 Patched in ["3.2.15"] CVE-2018-20980

Ninja Forms Contact Form <= 3.2.13 - Cross-Site Scripting Medium

February 20, 2018 Patched in ["3.2.14"] CVE-2018-7280

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.31 - Arbitrary Wordpress Shortcode Injection Medium

April 17, 2017 Patched in ["3.0.32"]

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.0.30 - HTML Injection Medium

March 7, 2017 Patched in ["3.0.31"] CVE-2017-18574

Ninja Forms Contact Form <= 2.9.55.1 - Authenticated SQL Injection High

August 16, 2016 Patched in ["2.9.55.2"]

Ninja Forms Contact Form <= 2.9.51 - Multiple Reflected Cross-Site Scripting Medium

July 19, 2016 Patched in ["2.9.52"]

Ninja Forms Contact Form 2.9.36 - 2.9.42 - PHP Object Injection High

May 13, 2016 Patched in ["2.9.42.1"] CVE-2016-1209

Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload Critical

May 5, 2016 Patched in ["2.9.42.1"] CVE-2016-1209

Ninja Forms Contact Form <= 2.9.28 - Stored Cross-Site Scripting High

December 8, 2015 Patched in ["2.9.29"]

Ninja Forms Contact Form <= 2.9.27 - CSV Injection High

September 30, 2015 Patched in ["2.9.28"]

Ninja Forms Contact Form <= 2.9.21 - Reflected Cross-Site Scripting Medium

August 4, 2015 Patched in ["2.9.22"]

Ninja Forms Contact Form <= 2.9.18 - Cross-Site Scripting Medium

June 5, 2015 Patched in ["2.9.19"]

Ninja Forms <= 2.9.10 - Reflected Cross-Site Scripting Medium

April 20, 2015 Patched in ["2.9.11"]

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.8 - Reflected Cross-Site Scripting Medium

December 2, 2014 Patched in ["2.8.10"] CVE-2014-9688

Ninja Forms Contact Form <= 2.8.8 - Stored Cross-Site Scripting High

November 20, 2014 Patched in ["2.8.9"] CVE-2015-2220

Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 2.8.6 - Reflected Cross-Site Scripting Medium

November 6, 2014 Patched in ["2.8.7"] CVE-2014-8815

What It Does

Ninja Forms is a drag-and-drop form builder for WordPress that lets you create contact forms, lead forms, registration forms, and similar submissions without writing code. It provides field controls, basic styling, and integrations through optional add-ons for payments, CRM connections, and conditional logic.

Who It's For

This plugin fits small-to-medium WordPress site owners who want a free, low-friction way to add professional-looking forms without paying for a premium tier. It is well suited for bloggers, local businesses, and non-profits running WP 6.8 or newer on PHP 7.4+.

Who Should Skip It

If you need advanced features like conversational forms, AI-assisted building, or built-in payment processing out of the box, you will likely be better served by WPForms or Forminator. Developers who prefer raw shortcode simplicity over a UI builder should also look at Contact Form 7.

The Bottom Line

Ninja Forms earns a strong 86.58/100 overall and is a dependable free option for standard contact and registration forms on modern WordPress sites. Its weak support health score and lower ratings compared to WPForms and Forminator mean users who value responsive help or cutting-edge features should look elsewhere.

Pick Akismet alongside any form plugin when spam filtering is your primary concern rather than form building.

WPForms Lite 97/100

Choose WPForms if you want a more polished UI, better support history, and AI-assisted form creation.

Forminator Forms 94/100

Choose Forminator if you need built-in payment, quiz, and poll features without paying for add-ons.

Fluent Forms 88/100

Pick Fluent Forms if you want a comparable feature set with a similar install base and slightly higher overall score.

Contact Form 7 88/100

Choose Contact Form 7 if you prefer a lightweight, shortcode-based approach and do not need a visual builder.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

About

Security History

What It Does

Who It's For

Who Should Skip It

The Bottom Line

Related Plugins

Tags