WordPress News
Ninja Forms 3.15.7 Released
What’s new in Ninja Forms 3.15.7
Released: (2 November 2026)
Active installations: 500,000
Tested up to WordPress 7.1.3
Requires PHP 7.4
Changelog
- verify the license server’s certificate when checking and activating licenses
- apply the site’s unfiltered HTML restriction to the Not Logged-In and Limit Reached messages
- show option labels in form builder dropdown settings as plain text
- harden merge tag handling of submitted values, visitor IP address, referring page and post details
- enforce the “Require user to be logged in” setting when a form is submitted
- keep hand-coded tables intact in the Email action message editor
- load the Email action rich text editor correctly when a message contains older table markup
- keep Checkbox List calculations working when an option has a blank calc value
- count only typed characters toward the character limit on fields with an input mask
- show an error when a favorite field could not be deleted instead of appearing to remove it
- keep a form’s display name when it is imported
- fill in {submission:sequence} in emails re-sent from the Submissions page
Previous releases
3.15.6 — (15 October 2026)
- protect HTML fields against script injection through query string merge tag values
- block shortcode execution through submitted field values in Success Message merge tags
- block shortcode execution through the {wp:user_display_name} merge tag
- protect stored submission data against cross-site scripting
- give each Email action CSV attachment its own private file
3.15.5 — (28 September 2026)
- strengthen sanitization of Paragraph Text (Rich Text) field submissions against stored cross-site scripting
- save File Upload and other fields inside a Repeatable Fieldset correctly
- remove “Undefined array key fields-save-toggle” PHP warning when saving submissions
- remove foreach() PHP warnings when a repeatable fieldset is left blank
- display calculation values with the correct locale separator in form actions