WordPress News
Ninja Forms 3.15.4 Released
What’s new in Ninja Forms 3.15.4
Released: (21 September 2026)
Active installations: 500,000
Tested up to WordPress 7.1.1
Requires PHP 7.4
Changelog
- strengthen output escaping in admin submission edit screen; responsibly reported by Venkateswara Reddy Challa
- protect CSV export against object injection in stored submission data
- enforce server-side option validation for list fields
- add CSS class setting to Hidden fields
- make Select Image field mobile responsive
- use relative paths for image URLs in Select Image field
- fix JavaScript error when deleting forms in dashboard
- resolve PHP warning for undefined reCAPTCHA settings key
- display form title correctly when heading level is unset
- return proper error when submission abilities reference nonexistent submission
- prevent fatal memory error on Get Help page with large debug logs
- silence PHP 8 warning from add-on update checker when store returns no record
Previous releases
3.15.3 — (07 September 2026)
- strengthen input validation for unserialize() operations
- preserve newsletter action list selection when provider connection is temporarily unavailable
- encode special characters correctly in CSV submission exports
- allow optional and hidden Date/Time fields to pass validation
- keep rich text editor scrollbar visible and functional in all views
3.15.2 — (31 August 2026)
- enforce granular two-tier permission model in Abilities API, responsibly reported by ChinhNguyen
- neutralize shortcode brackets in IP address and referer URL merge tags, responsibly reported by Jakub Herman
- validate repeater child field entries against server-side definitions
- apply context-correct output escaping in legacy submissions admin
- ensure shortcode neutralization callback is accessible for array inputs