Mendbird
Menu

The plugin register. Used on 500,000+ sites

Ninja Forms

125known security flaws found in Ninja Forms
since September 2014

5 with no fix yet

Version 3.15.6 or later fixes the others. 5 have no fix yet. A site on an older version is open to them.

Or let us look for you

Free, with no sign up. About ten seconds, and nothing on your site is touched. See an example report

When they were found.

Advisory: Missing checks, September 2014Advisory: Cross-site scripting, November 2014Advisory: Cross-site scripting, November 2014Advisory: Cross-site scripting, December 2014Advisory: a security flaw, April 2015Advisory: Cross-site scripting, April 2015Advisory: a security flaw, June 2015Advisory: Cross-site scripting, June 2015Advisory: a security flaw, August 2015Advisory: Cross-site scripting, August 2015Advisory: a security flaw, September 2015Advisory: a security flaw, September 2015Advisory: Cross-site scripting, December 2015Dangerous: Running code, December 2015Advisory: a security flaw, July 2016Advisory: Cross-site scripting, July 2016Advisory: a security flaw, August 2016Advisory: Database injection, August 2016Minor: Cross-site scripting, March 2017Advisory: Running code, April 2017Minor: Cross-site scripting, February 2018Major: a security flaw, February 2018Dangerous: a security flaw, July 2018Major: a security flaw, August 2018Advisory: Cross-site scripting, August 2018Advisory: a security flaw, August 2018Advisory: Cross-site scripting, August 2018Minor: Cross-site scripting, November 2018Minor: Open redirect, December 2018Dangerous: Database injection, January 2019Advisory: Cross-site scripting, June 2019Advisory: Database injection, June 2019Minor: Cross-site scripting, February 2020Minor: Forged requests, April 2020Minor: Cross-site scripting, September 2020Minor: Forged requests, September 2020Minor: a security flaw, September 2020Advisory: Forged requests, September 2020Minor: Open redirect, February 2021Major: Information leak, February 2021Minor: Information leak, February 2021Minor: Forged requests, February 2021Advisory: Forged requests, February 2021Advisory: Open redirect, February 2021Advisory: a security flaw, February 2021Advisory: a security flaw, February 2021Minor: Missing checks, September 2021Minor: Missing checks, September 2021Minor: Cross-site scripting, September 2021Major: Database injection, October 2021Advisory: a security flaw, March 2022Advisory: Information leak, March 2022Minor: Cross-site scripting, June 2022Advisory: Forged requests, June 2022Minor: Cross-site scripting, June 2022Minor: Cross-site scripting, June 2022Advisory: Running code, June 2022Advisory: Running code, June 2022Major: Running code, September 2022Minor: Cross-site scripting, April 2023Minor: Running code, June 2023Minor: Knocking it over, July 2023Major: Cross-site scripting, July 2023Major: Missing checks, July 2023Major: Missing checks, July 2023Minor: Cross-site scripting, August 2023Minor: Cross-site scripting, October 2023Dangerous: Database injection, February 2024Minor: Cross-site scripting, March 2024Minor: Cross-site scripting, March 2024Minor: Cross-site scripting, April 2024Minor: Cross-site scripting, April 2024Major: Forged requests, April 2024Dangerous: Running code, July 2024Major: Forged requests, July 2024Minor: Cross-site scripting, August 2024Minor: Cross-site scripting, August 2024Advisory: Cross-site scripting, September 2024Minor: Cross-site scripting, September 2024Minor: Cross-site scripting, October 2024Minor: Cross-site scripting, October 2024Major: Cross-site scripting, December 2024Minor: Running code, December 2024Minor: Cross-site scripting, January 2025Minor: Cross-site scripting, April 2025Minor: Cross-site scripting, April 2025Minor: Cross-site scripting, April 2025Minor: Cross-site scripting, June 2025Dangerous: Running code, August 2025Minor: Forged requests, September 2025Minor: Forged requests, September 2025Minor: Missing checks, December 2025Major: Missing checks, December 2025Advisory: Information leak, February 2026Advisory: Information leak, March 2026Major: Missing checks, June 2026Major: a security flaw, July 2026Minor: a security flaw, July 2026Minor: Missing checks, July 2026Dangerous: a security flaw, July 2026Dangerous: Cross-site scripting, July 2026Advisory: Database injection, July 2026Major: Cross-site scripting, July 2026Minor: a security flaw, August 2026Advisory: Missing checks, September 2026Minor: Running code, September 2026Minor: Running code, September 2026Major: Cross-site scripting, September 2026Major: Cross-site scripting, September 2026Major: Running code, September 2026Major: Cross-site scripting, September 2026Major: Cross-site scripting, September 2026Major: Cross-site scripting, September 2026Major: Cross-site scripting, October 20262014201620182020202220242026

DangerousMajorMinorAdvisory

What they could let someone do.

What could happen

  • Cross-site scripting

    Someone could make your pages run their own script in visitors' browsers, to steal logins, show a fake payment form or send people to a scam site.

    How: The software puts text it was sent back onto a page without making it safe first, so a script hidden in a link, form or comment runs as if it were part of your site.

    Read about it here
  • Running code

    Someone could run their own code on the server and take the site over: add malware, send spam, steal data, or use it to attack others.

    How: Part of the software treats something it was sent as instructions to follow, or keeps an uploaded file somewhere it can be run.

    Read about it here
  • Database injection

    Someone could read or change what is in the site's database: customer details, orders, password records, or a new administrator account.

    How: The software builds its questions to the database out of what visitors type, so carefully written input changes the question itself.

    Read about it here
Every known flaw, newest first (125)
  1. October 2026MajorCross-site scriptingFixed in 3.15.6. No login needed.
  2. September 2026MajorCross-site scriptingFixed in 3.15.5. No login needed.
  3. September 2026MajorCross-site scriptingFixed in 3.15.5. No login needed.
  4. September 2026MajorCross-site scriptingFixed in 3.15.4. No login needed.
  5. September 2026MajorRunning codeFixed in 3.15.4. No login needed.
  6. September 2026MajorCross-site scriptingFixed in 3.15.4. No login needed.
  7. September 2026MajorCross-site scriptingFixed in 3.15.4. No login needed.
  8. September 2026MinorRunning codeFixed in 3.15.2. No login needed.
  9. September 2026AdvisoryMissing checksFixed in 3.15.2. Needs a login on the site (Custom Role+).
  10. September 2026MinorRunning codeFixed in 3.14.7. Needs a login on the site (Administrator+).
  11. August 2026MinorA security flawFixed in 3.14.10. No login needed.
  12. July 2026AdvisoryDatabase injectionFixed in 3.14.10. Needs a login on the site (Administrator+).
  13. July 2026MajorCross-site scriptingFixed in 3.15.2. No login needed.
  14. July 2026MajorA security flawNo fix yet. No login needed.
  15. July 2026MinorA security flawNo fix yet. No login needed.
  16. July 2026MinorMissing checksNo fix yet. Needs a login on the site.
  17. July 2026DangerousA security flawNo fix yet. No login needed.
  18. July 2026DangerousCross-site scriptingNo fix yet. No login needed.
  19. June 2026MajorMissing checksFixed in 3.14.2. No login needed.
  20. March 2026AdvisoryInformation leakFixed in 3.14.2. Needs a login on the site (Contributor+).
  21. February 2026AdvisoryInformation leakFixed in 3.14.1. No login needed.
  22. December 2025MajorMissing checksFixed in 3.13.3. No login needed.
  23. December 2025MinorMissing checksFixed in 3.13.3. No login needed.
  24. September 2025MinorForged requestsFixed in 3.12.1. No login needed.
  25. September 2025MinorForged requestsFixed in 3.12.1. No login needed.
  26. August 2025DangerousRunning codeFixed in 3.11.1. No login needed.
  27. June 2025MinorCross-site scriptingFixed in 3.10.2.2. Needs a login on the site (Contributor+).
  28. April 2025MinorCross-site scriptingFixed in 3.10.1. Needs a login on the site.
  29. April 2025MinorCross-site scriptingFixed in 3.10.1. Needs a login on the site.
  30. April 2025MinorCross-site scriptingFixed in 3.10.1. Needs a login on the site.
  31. January 2025MinorCross-site scriptingFixed in 3.8.25. Needs a login on the site (Contributor+).
  32. December 2024MinorRunning codeFixed in 3.8.23. Needs a login on the site (Subscriber+).
  33. December 2024MajorCross-site scriptingFixed in 3.8.20. No login needed.
  34. October 2024MinorCross-site scriptingFixed in 3.8.18. Needs a login on the site.
  35. October 2024MinorCross-site scriptingFixed in 3.8.18. Needs a login on the site.
  36. September 2024MinorCross-site scriptingFixed in 3.8.16. No login needed.
  37. September 2024AdvisoryCross-site scripting
  38. August 2024MinorCross-site scriptingFixed in 3.8.12. Needs a login on the site.
  39. August 2024MinorCross-site scriptingFixed in 3.8.11. No login needed.
  40. July 2024MajorForged requestsFixed in 3.8.7. No login needed.
  41. July 2024DangerousRunning codeFixed in 3.8.5. No login needed.
  42. April 2024MinorCross-site scriptingFixed in 3.8.1. No login needed.
  43. April 2024MinorCross-site scriptingFixed in 3.8.1. Needs a login on the site (Admin+).
  44. April 2024MajorForged requestsFixed in 3.8.1. No login needed.
  45. March 2024MinorCross-site scriptingFixed in 3.8.1. Needs a login on the site (Author+).
  46. March 2024MinorCross-site scriptingFixed in 3.8.1. No login needed.
  47. February 2024DangerousDatabase injectionFixed in 3.7.2. No login needed.
  48. October 2023MinorCross-site scriptingFixed in 3.6.34. Needs a login on the site (Admin+).
  49. August 2023MinorCross-site scriptingFixed in 3.6.26. Needs a login on the site (Administrator+).
  50. July 2023MajorCross-site scriptingFixed in 3.6.26. No login needed.
  51. July 2023MajorMissing checksFixed in 3.6.26. Needs a login on the site.
  52. July 2023MajorMissing checksFixed in 3.6.26. Needs a login on the site.
  53. July 2023MinorKnocking it overFixed in 3.6.26. No login needed.
  54. June 2023MinorRunning codeFixed in 3.6.25. Needs a login on the site.
  55. April 2023MinorCross-site scriptingFixed in 3.6.22. No login needed.
  56. September 2022MajorRunning codeFixed in 3.6.13. Needs a login on the site.
  57. June 2022AdvisoryRunning code No login needed.
  58. June 2022AdvisoryRunning codeFixed in 3.6.11.
  59. June 2022MinorCross-site scriptingFixed in 3.6.10. Needs a login on the site.
  60. June 2022MinorCross-site scriptingFixed in 3.6.11. Needs a login on the site.
  61. June 2022MinorCross-site scriptingFixed in 3.6.10. Needs a login on the site.
  62. June 2022AdvisoryForged requestsFixed in 3.6.10.
  63. March 2022AdvisoryA security flawFixed in 3.6.8. No login needed.
  64. March 2022AdvisoryInformation leakFixed in 3.6.8.
  65. October 2021MajorDatabase injectionFixed in 3.6.4. Needs a login on the site.
  66. September 2021MinorCross-site scriptingFixed in 3.6.8. Needs a login on the site.
  67. September 2021MinorMissing checksFixed in 3.5.8. Needs a login on the site.
  68. September 2021MinorMissing checksFixed in 3.5.8. Needs a login on the site.
  69. February 2021MinorOpen redirectFixed in 3.4.34. No login needed.
  70. February 2021MajorInformation leakFixed in 3.4.34. Needs a login on the site.
  71. February 2021MinorInformation leakFixed in 3.4.34.1. Needs a login on the site.
  72. February 2021MinorForged requestsFixed in 3.4.34. No login needed.
  73. February 2021AdvisoryForged requestsFixed in 3.4.34.
  74. February 2021AdvisoryOpen redirectFixed in 3.4.34.
  75. February 2021AdvisoryA security flawFixed in 3.4.34.
  76. February 2021AdvisoryA security flawFixed in 3.4.34.
  77. September 2020MinorForged requestsFixed in 3.4.27.1. No login needed.
  78. September 2020MinorA security flawFixed in 3.4.27.1. No login needed.
  79. September 2020AdvisoryForged requestsFixed in 3.4.27.1.
  80. September 2020MinorCross-site scriptingFixed in 3.4.28. No login needed.
  81. April 2020MinorForged requestsFixed in 3.4.24.2. No login needed.
  82. February 2020MinorCross-site scriptingFixed in 3.4.23. Needs a login on the site.
  83. June 2019AdvisoryCross-site scriptingFixed in 3.3.21.3.
  84. June 2019AdvisoryDatabase injectionFixed in 3.3.21.3.
  85. January 2019DangerousDatabase injectionFixed in 3.3.21.2. No login needed.
  86. December 2018MinorOpen redirectFixed in 3.3.19.1. No login needed.
  87. November 2018MinorCross-site scriptingFixed in 3.3.18. No login needed.
  88. August 2018AdvisoryA security flawFixed in 3.3.14.
  89. August 2018AdvisoryCross-site scriptingFixed in 3.3.14.
  90. August 2018AdvisoryCross-site scriptingFixed in 3.3.14.
  91. August 2018MajorA security flawFixed in 3.3.14. No login needed.
  92. July 2018DangerousA security flawFixed in 3.3.9. No login needed.
  93. February 2018MajorA security flawFixed in 3.2.15. No login needed.
  94. February 2018MinorCross-site scriptingFixed in 3.2.14. No login needed.
  95. April 2017AdvisoryRunning codeFixed in 3.0.32.
  96. March 2017MinorCross-site scriptingFixed in 3.0.31. No login needed.
  97. August 2016AdvisoryA security flawFixed in 2.9.55.2.
  98. August 2016AdvisoryDatabase injectionFixed in 2.9.55.2.
  99. July 2016AdvisoryA security flawFixed in 2.9.52.
  100. July 2016AdvisoryCross-site scriptingFixed in 2.9.52.

And 25 older ones.

From the public lists of known flaws, checked daily. A flaw is listed once it is made public, often after a fix is out.

Be told the day a new one is found.

Mendbird checks your site every morning against the lists of known flaws, and emails you in plain English the day one hits something you run. Free for 14 days, then £9 a month.

Start my free trial