WordPress News
Ninja Forms 3.15.6 Released
What’s new in Ninja Forms 3.15.6
Released: (15 October 2026)
Active installations: 500,000
Tested up to WordPress 7.1.3
Requires PHP 7.4
Changelog
- protect HTML fields against script injection through query string merge tag values
- block shortcode execution through submitted field values in Success Message merge tags
- block shortcode execution through the {wp:user_display_name} merge tag
- protect stored submission data against cross-site scripting
- give each Email action CSV attachment its own private file
- always escape field values in Email and Success Message actions, regardless of how the action was saved
- restore the Quote Request form template
- make the resize handle work in the Email action HTML source editor
- return the correct URL from {wp:post_url} when a form is on the home page
- remove the “Undefined variable $errors” PHP warning from Confirm fields
- show Repeatable Fieldset values on the Submissions page after switching forms
- keep List field values from being copied into new entries when a form has more than one Repeatable Fieldset
Previous releases
3.15.5 — (28 September 2026)
- strengthen sanitization of Paragraph Text (Rich Text) field submissions against stored cross-site scripting
- save File Upload and other fields inside a Repeatable Fieldset correctly
- remove “Undefined array key fields-save-toggle” PHP warning when saving submissions
- remove foreach() PHP warnings when a repeatable fieldset is left blank
- display calculation values with the correct locale separator in form actions
3.15.4 — (21 September 2026)
- strengthen output escaping in admin submission edit screen; responsibly reported by Venkateswara Reddy Challa
- protect CSV export against object injection in stored submission data
- enforce server-side option validation for list fields
- add CSS class setting to Hidden fields
- make Select Image field mobile responsive