Skip to content
PluginCanary

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder

by Kevin Stover · 500,000+ active installs · Checked 3 Nov 2026
Watch15 Warnings

Watch: vulnerability published 30 Oct 2026, fixed in 3.15.6.

79/ 100 Canary Score
Sub-scores for Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Ownership100
Maintenance100
Security50
Support60
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 3.15.6. Update to version 3.15.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 3.15.6. Update to version 3.15.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 3.15.6. Update to version 3.15.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 3.15.6. Update to version 3.15.6 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 19 Oct 2026, fixed in 3.15.6. Update to version 3.15.6 or later.19 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 1 Oct 2026, fixed in 3.15.5. Update to version 3.15.5 or later.1 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 3.15.5. Update to version 3.15.5 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 23 Sep 2026, fixed in 3.15.4. Update to version 3.15.4 or later.23 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 3.15.4. Update to version 3.15.4 or later.22 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 3.15.4. Update to version 3.15.4 or later.22 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 3.15.4. Update to version 3.15.4 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 3.14.7. Update to version 3.14.7 or later.8 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 4 Sep 2026, fixed in 3.15.2. Update to version 3.15.2 or later.4 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 4 Sep 2026, fixed in 3.15.2. Update to version 3.15.2 or later.4 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 2 Sep 2026, fixed in 3.15.2. Update to version 3.15.2 or later.2 Sep 2026Evidence
  • InfoSEC-332 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
kstover21 Dec 2011 to 7 Jun 2021, 440 commits
krmoorhouse13 Dec 2017 to 7 Jan 2026, 155 commits
nahuelmahe17 Aug 2021 to 2 Nov 2026, 121 commits

3 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
77
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Q1 202455
Q2 20240
Q3 20240
Q4 20240
Q1 20252
Q2 20250
Q3 20252
Q4 202541
Q1 202613
Q2 20266
Q3 202610
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

60% of 10 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter6.1<= 3.15.53.15.60
30 Oct 2026Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag6.5<= 3.15.53.15.60
30 Oct 2026Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name5.4<= 3.15.53.15.60
30 Oct 2026Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization7.2<= 3.15.53.15.60
19 Oct 2026Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.15.53.15.60
1 Oct 2026Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission7.2<= 3.15.43.15.50
30 Sep 2026Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.15.33.15.50
23 Sep 2026Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.15.33.15.40
22 Sep 2026Ninja Forms <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.15.33.15.40
22 Sep 2026Ninja Forms <= 3.15.3 - Unauthenticated PHP Object Injection8.1<= 3.15.33.15.40
21 Sep 2026Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 3.15.33.15.40
8 Sep 2026Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import6.6<= 3.14.63.14.70
4 Sep 2026Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key7.2<= 3.15.13.15.20
4 Sep 2026Ninja Forms – The Contact Form Builder That Grows With You 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution6.53.14.10 to 3.15.13.15.20
2 Sep 2026Ninja Forms – The Contact Form Builder That Grows With You 3.14.0 - 3.15.1 - Authenticated (Custom Role+) Information Exposure3.13.14.0 to 3.15.13.15.20
27 Jul 2026Ninja Forms <= 3.14.9 - Unauthenticated Arbitrary Shortcode Execution5.3<= 3.14.93.14.100
23 Jul 2026Ninja Forms <= 3.14.9 - Authenticated (Administrator+) SQL Injection via Import File 'settings' Key4.9<= 3.14.93.14.100
30 Jun 2026Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint7.5<= 3.14.13.14.20
27 Mar 2026Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token6.5<= 3.14.13.14.20
9 Feb 2026Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action7.5<= 3.14.03.14.10
16 Dec 2025Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token7.5<= 3.13.23.13.30
12 Dec 2025Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure7.5<= 3.13.23.13.30
26 Sep 2025Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update4.3<= 3.12.03.12.180
26 Sep 2025Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion4.3<= 3.12.03.12.180
28 Aug 2025Ninja Forms <= 3.11.0 - Unauthenticated PHP Object Injection8.1<= 3.11.03.11.10

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
Q3 20255.0
Q4 20254.1
Q1 20264.6
Q2 20264.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q3 2025 and Q4 2026.

Rating distribution
5 star1099
4 star67
3 star41
2 star40
1 star150
Latest low reviews

Momentum

500,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
4 May 202621,330
11 May 2026263,007
18 May 202670,293
25 May 2026262,541
1 Jun 202648,674
8 Jun 2026256,691
15 Jun 202645,910
22 Jun 2026254,362
29 Jun 2026263,976
6 Jul 202674,608
13 Jul 2026277,012
20 Jul 2026268,443
27 Jul 2026270,485
3 Aug 202670,475
10 Aug 2026486,852
17 Aug 202656,748
24 Aug 2026263,244
31 Aug 2026273,994
7 Sep 2026253,588
14 Sep 202663,372
21 Sep 2026290,157
28 Sep 2026261,369
5 Oct 202669,001
12 Oct 2026232,189
19 Oct 202672,375
26 Oct 2026285,341
2 Nov 202645,278

Weekly downloads over the last 4 weeks are 16% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - JotformScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Contact Form Clean and SimpleScore 91 · 7,000+Formzu WPScore 91 · 3,000+Woorise - Forms, Quizzes & GiveawaysScore 91 · 1,000+

Facts

Version3.16.0
AuthorKevin Stover
Added21 Dec 2011
Last updated2 Nov 2026
Active installs500,000+
Requires WordPress6.9
Tested up to7.1.4
Requires PHP7.4
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, lead form, contact form, form builder, Calculator form

Other plugins by this author: SendWP, Ninja Announcements Lite, Ninja Shop - The Quickest Way to Start Selling, Ninja Galleries

Questions

Is Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder still maintained?

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder was last updated on 2 Nov 2026. Its Canary status is Watch.

Is Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder safe?

Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder has no open unpatched vulnerabilities on record. 32 vulnerabilities were published in the last 24 months. Its Canary status is Watch.

Who owns Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder?

The wordpress.org author is Kevin Stover. Recent committers: nahuelmahe, krmoorhouse, kstover, ericwindhamsd, kbjohnson90. We have recorded no ownership change.

What can I use instead of Ninja Forms - Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder?

Plugins in the same category with a higher Canary Score: Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - Jotform, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Contact Form Clean and Simple, Formzu WP, Woorise - Forms, Quizzes & Giveaways.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue