Broken Access Control in Ninja Forms Telemetry REST Endpoint

Skrevet den af i Ninja Forms – The Contact Form Builder

The telemetry REST route’s permission callback only required a logged-in user, so any authenticated user including a subscriber could write arbitrary data into the wp_options table. The route now requires the manage_options capability and validates and sanitises the submitted payload.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4

PHP Object Injection in Ninja Forms Submission CSV Export

Skrevet den af i Ninja Forms – The Contact Form Builder

Unauthenticated attackers can submit serialized PHP data in form fields that Ninja Forms unserializes when an administrator exports submissions to CSV. If a suitable POP chain exists in another installed plugin or theme, this can lead to arbitrary file operations or remote code execution. Sites running Ninja Forms 3.15.3 and earlier are affected.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4
  • Ninja Forms – The Contact Form Builder 3.14.5
  • Ninja Forms – The Contact Form Builder 3.14.6
  • Ninja Forms – The Contact Form Builder 3.14.7
  • Ninja Forms – The Contact Form Builder 3.14.8
  • Ninja Forms – The Contact Form Builder 3.14.9
  • Ninja Forms – The Contact Form Builder 3.14.10
  • Ninja Forms – The Contact Form Builder 3.14.11
  • Ninja Forms – The Contact Form Builder 3.14.12
  • Ninja Forms – The Contact Form Builder 3.15.0
  • Ninja Forms – The Contact Form Builder 3.15.1
  • Ninja Forms – The Contact Form Builder 3.15.2
  • Ninja Forms – The Contact Form Builder 3.15.3

Stored Cross-Site Scripting in Ninja Forms Submission Editor

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms up to 3.15.3 prints several submitted field values (textarea and date values, list option labels and repeater labels) unescaped on the admin edit-submission screen. An unauthenticated visitor can submit a form with a script payload that runs in an administrator’s browser when they open the submission for editing.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.4.34.2
  • Ninja Forms – The Contact Form Builder 3.4.34.3
  • Ninja Forms – The Contact Form Builder 3.5.8.4
  • Ninja Forms – The Contact Form Builder 3.5.8.5
  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4
  • Ninja Forms – The Contact Form Builder 3.14.5
  • Ninja Forms – The Contact Form Builder 3.14.6
  • Ninja Forms – The Contact Form Builder 3.14.7
  • Ninja Forms – The Contact Form Builder 3.14.8
  • Ninja Forms – The Contact Form Builder 3.14.9
  • Ninja Forms – The Contact Form Builder 3.14.10
  • Ninja Forms – The Contact Form Builder 3.14.11
  • Ninja Forms – The Contact Form Builder 3.14.12
  • Ninja Forms – The Contact Form Builder 3.15.0
  • Ninja Forms – The Contact Form Builder 3.15.1
  • Ninja Forms – The Contact Form Builder 3.15.2
  • Ninja Forms – The Contact Form Builder 3.15.3

Authenticated (Admin+) Stored Cross-Site Scripting in Ninja Forms Field Settings

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms before 3.10.1 does not sanitise or escape several form-field settings before storing them, so an administrator can inject arbitrary JavaScript even when the unfiltered_html capability is disallowed. On multisite installations this lets a site administrator run script in the browser of any user who views or edits the affected form, including network super administrators.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0

Cross-Site Scripting in Ninja Forms Success Message Action

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms before 3.14.1 output the Success Message action without HTML sanitisation and did not escape merge-tag values (such as submitted field values) inserted into it. An attacker can submit form input containing script markup that is rendered in the browser when the success message is displayed. The fix sanitises the message with wp_kses_post() and escapes merge-tag values in success messages.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0

Unauthenticated Information Disclosure via Repeater Field Merge Tags in Ninja Forms

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms up to and including 3.14.0 resolves merge tags inside user-submitted repeater field values during form submission (nf_ajax_submit). An unauthenticated attacker can submit merge tags such as {post_meta:KEY} to read arbitrary post metadata, including customer billing details, API keys and tokens. The fix stops merge-tag processing on user-submitted repeater values.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0

Shortcode Injection via Merge Tag Values in Ninja Forms

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms does not neutralize WordPress shortcode syntax in merge tag values, which can be populated from request-supplied form field defaults without authentication. Where merge tag output is later processed by do_shortcode(), an attacker-supplied [shortcode] is executed instead of displayed, allowing execution of any shortcode registered on the site.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.1.10
  • Ninja Forms – The Contact Form Builder 3.2.28
  • Ninja Forms – The Contact Form Builder 3.3.21.4
  • Ninja Forms – The Contact Form Builder 3.4.34.2
  • Ninja Forms – The Contact Form Builder 3.4.34.3
  • Ninja Forms – The Contact Form Builder 3.5.8.4
  • Ninja Forms – The Contact Form Builder 3.5.8.5
  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4
  • Ninja Forms – The Contact Form Builder 3.14.5
  • Ninja Forms – The Contact Form Builder 3.14.6
  • Ninja Forms – The Contact Form Builder 3.14.7
  • Ninja Forms – The Contact Form Builder 3.14.8
  • Ninja Forms – The Contact Form Builder 3.14.9

Stored Cross-Site Scripting in Ninja Forms Repeatable Fieldset

Skrevet den af i Ninja Forms – The Contact Form Builder

Ninja Forms before 3.14.9 does not escape the repetition index when rendering the submission summary for Repeatable Fieldset fields. An attacker who can manipulate form submission data may inject HTML or JavaScript that executes in the browser of anyone viewing the submission, such as site administrators reviewing entries. Sites using the Repeatable Fieldset feature on public forms are at risk.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4
  • Ninja Forms – The Contact Form Builder 3.14.5
  • Ninja Forms – The Contact Form Builder 3.14.6
  • Ninja Forms – The Contact Form Builder 3.14.7
  • Ninja Forms – The Contact Form Builder 3.14.8

Authenticated (Administrator+) SQL Injection via Import File ‘settings’ Key

Skrevet den af i Ninja Forms – The Contact Form Builder

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to generic SQL Injection via Import File ‘settings’ Key in all versions up to, and including, 3.14.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable keys originate from the ‘settings’ object in an attacker-controlled import file processed via file_get_contents() or base64-decoded/JSON-decoded blobs, bypassing wp_magic_quotes protections entirely; two distinct sinks are affected — _save_setting() in Model.php and insert_form_meta() in ImportForm.php — as only the value side is escaped while the key side receives no sanitization or parameterization at any point in the call chain.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0
  • Ninja Forms – The Contact Form Builder 3.10.1
  • Ninja Forms – The Contact Form Builder 3.10.2
  • Ninja Forms – The Contact Form Builder 3.10.2.1
  • Ninja Forms – The Contact Form Builder 3.10.2.2
  • Ninja Forms – The Contact Form Builder 3.10.3
  • Ninja Forms – The Contact Form Builder 3.10.4
  • Ninja Forms – The Contact Form Builder 3.10.4.1
  • Ninja Forms – The Contact Form Builder 3.11.0
  • Ninja Forms – The Contact Form Builder 3.11.1
  • Ninja Forms – The Contact Form Builder 3.11.1.1
  • Ninja Forms – The Contact Form Builder 3.12.0
  • Ninja Forms – The Contact Form Builder 3.12.1
  • Ninja Forms – The Contact Form Builder 3.12.2
  • Ninja Forms – The Contact Form Builder 3.12.2.1
  • Ninja Forms – The Contact Form Builder 3.13.0
  • Ninja Forms – The Contact Form Builder 3.13.1
  • Ninja Forms – The Contact Form Builder 3.13.2
  • Ninja Forms – The Contact Form Builder 3.13.3
  • Ninja Forms – The Contact Form Builder 3.13.4
  • Ninja Forms – The Contact Form Builder 3.14.0
  • Ninja Forms – The Contact Form Builder 3.14.1
  • Ninja Forms – The Contact Form Builder 3.14.2
  • Ninja Forms – The Contact Form Builder 3.14.3
  • Ninja Forms – The Contact Form Builder 3.14.4
  • Ninja Forms – The Contact Form Builder 3.14.5
  • Ninja Forms – The Contact Form Builder 3.14.6
  • Ninja Forms – The Contact Form Builder 3.14.7
  • Ninja Forms – The Contact Form Builder 3.14.8
  • Ninja Forms – The Contact Form Builder 3.14.9

Authenticated (Admin+) Stored Cross-Site Scripting in Ninja Forms Settings

Skrevet den af i Ninja Forms – The Contact Form Builder

An administrator-level user can inject HTML or JavaScript into a Ninja Forms field label; the payload is stored and executes when other administrators view the form settings panel. Affects Ninja Forms versions up to 3.8.16, fixed in 3.8.18.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17

Arbitrary Shortcode Execution in Ninja Forms Plugin

Skrevet den af i Ninja Forms – The Contact Form Builder

The plugin fails to properly validate user-supplied input before passing it to the do_shortcode function in the form preview functionality. This could allow attackers to execute unintended shortcodes, potentially leading to information disclosure, privilege escalation.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22

Unauthenticated Stored Cross-Site Scripting via Form Calculations

Skrevet den af i Ninja Forms – The Contact Form Builder

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.1.10
  • Ninja Forms – The Contact Form Builder 3.2.28
  • Ninja Forms – The Contact Form Builder 3.3.21.4
  • Ninja Forms – The Contact Form Builder 3.4.34.2
  • Ninja Forms – The Contact Form Builder 3.4.34.3
  • Ninja Forms – The Contact Form Builder 3.5.8.4
  • Ninja Forms – The Contact Form Builder 3.5.8.5
  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19

Authenticated (contributor+) stored cross-site scripting via shortcode

Skrevet den af i Ninja Forms – The Contact Form Builder

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24

XSS in new admin form template

Skrevet den af i Ninja Forms – The Contact Form Builder

A vulnerability in Ninja Forms allowed unescaped form field values to be displayed in the WordPress admin. This created a risk of stored Cross-Site Scripting (XSS), where a malicious actor could inject harmful JavaScript into form data.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17
  • Ninja Forms – The Contact Form Builder 3.8.18
  • Ninja Forms – The Contact Form Builder 3.8.19
  • Ninja Forms – The Contact Form Builder 3.8.20
  • Ninja Forms – The Contact Form Builder 3.8.21
  • Ninja Forms – The Contact Form Builder 3.8.22
  • Ninja Forms – The Contact Form Builder 3.8.23
  • Ninja Forms – The Contact Form Builder 3.8.24
  • Ninja Forms – The Contact Form Builder 3.8.25
  • Ninja Forms – The Contact Form Builder 3.8.25.1
  • Ninja Forms – The Contact Form Builder 3.9.0
  • Ninja Forms – The Contact Form Builder 3.9.1
  • Ninja Forms – The Contact Form Builder 3.9.2
  • Ninja Forms – The Contact Form Builder 3.9.2.1
  • Ninja Forms – The Contact Form Builder 3.10.0

Reflected self-based cross-site scripting via request referrer

Skrevet den af i Ninja Forms – The Contact Form Builder

Vulnerability to reflected self-based cross-site scripting via the referer header due to insufficient input sanitization and output escaping; an attacker could inject scripts that execute if a user is tricked into acting (for example, clicking a link). exploitation requires a temporary maintenance mode that cannot be enabled by attackers or administrators and is only active during a brief update window, which greatly limits practical impact, and the self-based nature of the issue means attackers must chain additional techniques to run a payload in the targeted user’s context.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.4.34.2
  • Ninja Forms – The Contact Form Builder 3.4.34.3
  • Ninja Forms – The Contact Form Builder 3.5.8.4
  • Ninja Forms – The Contact Form Builder 3.5.8.5
  • Ninja Forms – The Contact Form Builder 3.6.34
  • Ninja Forms – The Contact Form Builder 3.6.34.1
  • Ninja Forms – The Contact Form Builder 3.7.3
  • Ninja Forms – The Contact Form Builder 3.7.3.1
  • Ninja Forms – The Contact Form Builder 3.8.0
  • Ninja Forms – The Contact Form Builder 3.8.1
  • Ninja Forms – The Contact Form Builder 3.8.2
  • Ninja Forms – The Contact Form Builder 3.8.3
  • Ninja Forms – The Contact Form Builder 3.8.4
  • Ninja Forms – The Contact Form Builder 3.8.5
  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15

Authenticated (Admin+) Stored Cross-Site Scripting via admin settings

Skrevet den af i Ninja Forms – The Contact Form Builder

Authenticated admins can inject malicious scripts into settings, executed on affected pages for other users.

This vulnerability affects the following application versions:

  • Ninja Forms – The Contact Form Builder 3.8.6
  • Ninja Forms – The Contact Form Builder 3.8.7
  • Ninja Forms – The Contact Form Builder 3.8.8
  • Ninja Forms – The Contact Form Builder 3.8.9
  • Ninja Forms – The Contact Form Builder 3.8.10
  • Ninja Forms – The Contact Form Builder 3.8.11
  • Ninja Forms – The Contact Form Builder 3.8.12
  • Ninja Forms – The Contact Form Builder 3.8.13
  • Ninja Forms – The Contact Form Builder 3.8.14
  • Ninja Forms – The Contact Form Builder 3.8.15
  • Ninja Forms – The Contact Form Builder 3.8.16
  • Ninja Forms – The Contact Form Builder 3.8.17