Ninja Forms Vulnerability: Check Your Version and Update Today

You saw a headline, a host notice or a security plugin alert that says the form on your contact page has a hole in it. Now you want to know three things: is my site exposed, what do I click, and will the form still send messages afterward.

A Ninja Forms vulnerability sounds like an emergency, and for some versions it deserves a quick response. The good news is that the first move takes about ten minutes and you can do it from your WordPress dashboard. Open Plugins, find Ninja Forms, and read the version number next to it.

If it is 3.15.3 or lower, update today. Back up first, update, then send yourself a test message through the live form. The rest of this page tells you which flaw is which, how serious each one is, and when it makes sense to hand the job to someone else.

The fix takes ten minutes, and it starts in Plugins

Start with what you can see. In your WordPress admin, open Plugins and look for Ninja Forms. The version number sits under the plugin name. While you are on that screen, check whether Ninja Forms File Uploads or any other Ninja Forms add-on is installed and active, because each add-on has its own version and its own updates. WordPress.org explains how the Plugins screen works if you have not used it before.

Then take a backup. WordPress.org tells site owners to make sure they have a current backup before updating plugins, and the reason is practical: if the update clashes with your theme, your PHP version or another plugin, you want a way back. Your host may offer a one-click backup. A backup plugin works too. What matters is that it finished and that you know where it is.

Now update. You can use Dashboard, then Updates, or the Plugins screen. WordPress also lets you turn on automatic updates for individual plugins, which is worth considering for a form plugin that has needed repeated security fixes.

Last, test. Open your contact page in a private browser window, fill in the form with a test message, and send it. Check that the confirmation message shows, the notification email reaches your inbox, and the entry appears in your submissions list. If your form takes file uploads, send one with an attachment.

Update: Ninja Forms 3.15.6 was released on October 15, 2026, and adds further security enhancements. WordPress.org lists it as the current release on the Ninja Forms plugin page, so if your dashboard offers it, take it.

Three different flaws are being discussed, and each has its own fix

News coverage tends to blur these together. They are separate records, with separate versions, and the table below keeps them apart.

The CVE record for CVE-2026-94504 shows it was published on September 22, 2026, with Wordfence assigning a CVSS score of 7.1. The plugin stored text that a visitor typed into a non-rich-text textarea and then displayed it without safe HTML encoding in the older administrative submission editor. Version 3.15.4 added stronger output escaping on that screen. The NVD entry for CVE-2026-90438 covers the narrower Rich Text Editor case, and version 3.15.5 addresses it.

The third item is a different product. Wordfence documented active exploitation of a critical Ninja Forms File Uploads vulnerability in April 2026, and it lets an unauthenticated visitor upload arbitrary files. If you never installed that add-on, it does not apply to your site. If you did, update it separately and treat it as the more urgent of the three.

How serious CVE-2026-94504 is depends on one click by an administrator

Stored cross-site scripting works in two steps. First, someone puts a malicious script into a form field. Second, the script runs in the browser of a person who later opens that stored entry. Here, the first step needs no login: an attacker can send the content through the normal Ninja Forms form endpoint. Patchstack recorded attempts to exploit this flaw on October 5, 2026. The second step needs a logged-in administrator to open that submission in the legacy editor. The NVD record lists the same flaw.

That makes it a real reason to update this week, and it is not the same as someone taking over your site from the outside with no help. Two practical habits follow from it. Update promptly, and until you have, avoid opening submissions that look strange, such as entries full of symbols, code or odd links, from the Ninja Forms submissions screen.

Know which signs mean it is more than a routine update

The job is routine most of the time: back up, update, test. A few signs mean you should look further before you call it finished.

• Unfamiliar administrator accounts: Open Users and read every account with the Administrator role.
• Submissions that look like code: Entries made of symbols, script tags or long strings that no customer would type.
• Redirects or pop-ups on your site: Visitors sent somewhere you did not choose.
• Settings you did not change: New plugins, changed passwords or altered emails.

If any of these show up, an update alone will not clean it. Change your passwords, remove accounts you do not recognize, and have the site reviewed. A website security audit looks at accounts, plugins and files together, which is what you need once you suspect someone got in. If you see none of these signs, you do not need an audit for a routine update. Check, update, test, and move on.

Updating the main plugin does not update every add-on

The most common slip is updating Ninja Forms core and leaving a paid or free extension on an old release. Each extension ships its own version number. Look at your Plugins list for anything with Ninja Forms in the name, and check each one against its source. Paid add-ons may update through the vendor's license rather than through WordPress.org, so a pending update may not show up on your Updates screen. Log in to wherever you bought the add-on and check there.

A few other things go wrong after an update, and they are all fixable:

• Notifications stop arriving: Recheck the email action on your form and your mail settings, and look in your spam folder.
• A field looks different: Clear any caching plugin and your host's cache, then reload.
• The form shows an error: Restore the backup, then update the other plugins and your theme one at a time to find the clash.
• No backup exists and the update failed: Ask your host for a restore point before changing anything else.

Work through that list from the top, and stop at the first fix that works. These problems usually clear within a few minutes once you know which one you have.

Ninja Forms has needed security fixes often enough to plan for it

A single flaw is manageable. A pattern is a maintenance job. Wordfence's page for the plugin lists 76 known vulnerabilities, and Patchstack's database lists 74 patched issues with around 500,000 active installations. Those totals cover the plugin's whole history and different kinds of problems, so they do not mean every site was exposed to every one. They do show that a form plugin needs regular attention: version checks, backups, updates and a test after each one.

If you have a developer, a maintenance plan or a host that handles updates, that attention may already be covered. If you do not, decide who will do it. Website maintenance exists for this kind of recurring work, and a plan that includes backups and update testing removes the guesswork. Before paying for any plan, ask what is covered, how updates are tested and how fast a security update goes out.

Related reading

If this flaw got you thinking about the rest of your plugins, the guide to checking your WordPress plugins for security updates walks through a full review. The post on what to do after a WordPress plugin vulnerability warning covers verifying a notice before you act on it. If spam is the reason you added a form protection layer, see how to fix contact form spam without blocking real customers. Two other plugin flaws, Bricksforge and All in One SEO, are covered in the post on checking those plugins.

A contact form that runs without plugins

Once your site is updated, the next question is whether you want to keep patching a form plugin. A contact form often needs only a few fields, a spam check and a notification email. A site built without third-party plugins has no form plugin to patch, because the form is part of the site itself.

Web Leveling builds sites this way, and the code and accounts are yours. What that gives you is fewer components to track. It does not remove hosting, server or general security work, and if your form relies on integrations or complex logic, a plugin may still be the right tool. Make that choice on features and the time you have to maintain it, and not because of one CVE.

Frequently Asked Questions About ninja forms vulnerability

What version of Ninja Forms fixes CVE-2026-94504?

Version 3.15.4 or newer. Versions through 3.15.3 are affected.

Which version covers the Rich Text Editor issue?

CVE-2026-90438 affects versions through 3.15.4 when a Paragraph Text field has the Rich Text Editor turned on. Version 3.15.5 addresses it, and 3.15.6 is the current release as of October 15, 2026.

How do I check my Ninja Forms version?

Log in to WordPress, open Plugins, and read the version number under Ninja Forms. Check any Ninja Forms add-ons on the same screen.

Can a visitor attack my site without logging in?

A visitor can submit the harmful content through the form without logging in. The script runs only when a logged-in administrator opens that submission in the older admin editor, so updating and avoiding odd-looking entries both matter.

Does updating Ninja Forms also update the File Uploads add-on?

No. Treat each add-on separately and confirm every one you have installed is current.

Should I back up before updating?

Yes. WordPress.org says to keep a current backup before updating plugins. If the form breaks afterward, restore the backup or ask someone to review the update and the form's notification settings.

What This Means for You

Check the version number today. If it is below 3.15.4, update after you take a backup; the newest release covers the second flaw too. Update the File Uploads add-on on its own if you have it, and send a test message when you are done. Look at your administrator accounts once, because a routine update is not the same as cleaning up after a break-in.

Your contact form is how new customers reach you, so it deserves a regular check and not a scramble after each headline. A short routine, with a backup and a test after every update, keeps the form working and the risk small.

If you would rather not carry that routine yourself, Web Leveling can take it on through website maintenance, or you can contact us to talk through your form and your plugins in plain terms. We work with small and medium businesses across the country and overseas.

Terms