WordPress News
Ninja Forms 3.15.5 Released
What’s new in Ninja Forms 3.15.5
Released: (28 September 2026)
Active installations: 600,000
Tested up to WordPress 7.1.2
Requires PHP 7.4
Changelog
- strengthen sanitization of Paragraph Text (Rich Text) field submissions against stored cross-site scripting
- save File Upload and other fields inside a Repeatable Fieldset correctly
- remove “Undefined array key fields-save-toggle” PHP warning when saving submissions
- remove foreach() PHP warnings when a repeatable fieldset is left blank
- display calculation values with the correct locale separator in form actions
- stop embedded-page forms from reflecting unsaved builder changes
- hide unknown fields from merge tag name search results
- stop the “Congratulations” popup from appearing after every builder action
- send opt-in telemetry only once
- fix the AM/PM indicator for long date/time formats
- prevent an unnecessary redirect with GET parameters on a second submission
- fix the broken Front End Posting documentation link
Previous releases
3.15.4 — (21 September 2026)
- strengthen output escaping in admin submission edit screen; responsibly reported by Venkateswara Reddy Challa
- protect CSV export against object injection in stored submission data
- enforce server-side option validation for list fields
- add CSS class setting to Hidden fields
- make Select Image field mobile responsive
3.15.3 — (07 September 2026)
- strengthen input validation for unserialize() operations
- preserve newsletter action list selection when provider connection is temporarily unavailable
- encode special characters correctly in CSV submission exports
- allow optional and hidden Date/Time fields to pass validation
- keep rich text editor scrollbar visible and functional in all views