Ninja Forms File Uploads changelog

2026 14 versions

3.3.37 Latest 2 Nov 2026 8 fixed1 security

Fixed

• Fix uploaded files and their File Uploads entries being left behind when a submission is permanently deleted
• Fix empty folders being left in the uploads folder after files are removed because "Save to Server" is off
• Fix email merge tags linking to an uploaded file that was not saved anywhere
• Fix files from a submission turned down by validation, a unique-field match or a submission limit being kept and listed in File Uploads
• Fix PDF Submissions exports including files uploaded with other submissions
• *Security Enhancements:*
• Bind stored uploads to their form and field in merge tags, Zapier and submission records
• Protect public external file links with a per-file access key

Security

• Harden handling of uploaded file data during form submission

3.3.36 14 Oct 2026 5 fixed

Fixed

• Fix "maximum file size" error message always appearing in English on translated sites
• Fix fatal error when a large Amazon S3 upload fails in the background; the upload is now retried, then marked as failed
• Fix only the first file uploading when several files are dropped onto a File Upload field
• Fix Submit becoming available before every selected file has finished uploading
• Fix an upload in progress being shown as an error

3.3.35 5 Oct 2026 3 improved9 fixed

Improved

• Allow File Upload fields inside repeatable fieldsets to be sent to external storage
• Show an admin warning when an external storage service is disconnected automatically
• Show the Google Drive folder each uploaded file was saved to

Fixed

• Fix uploaded files being deleted when their external storage service is disconnected and "Save to Server" is off
• Fix files not reaching Google Drive when a Custom Directory is set
• Fix fatal error when a Google Drive upload fails; the file is now kept on the server and marked as failed in the admin
• Fix Google Drive connection being dropped on temporary network or proxy errors
• Fix bulk delete on the File Uploads screen failing with "The link you followed has expired"
• Fix maximum file count showing an error and blocking submission when the allowed number of files is selected
• Fix "Attach File Uploads" email option not appearing until the form is saved and reloaded
• Fix PHP warnings logged when a File Upload field in a repeatable fieldset is left empty
• Fix early translation loading notice on WordPress 6.7+ when Amazon S3 is connected

3.3.34 22 Sep 2026 5 fixed1 security1 changed

Fixed

• Fix chunked uploads being overwritten by a single chunk when a chunk request is repeated
• Fix HEIC/HEIF photo uploads failing on iPhone Safari due to a content/extension mismatch
• Fix uploaded files in repeatable fieldsets not reaching the email or submission when more than one fieldset is added
• Fix file size validation not enforcing PHP upload limits, allowing truncated files through
• Fix email action with attachments disabled inheriting another action's attachment settings when both send to the same recipient

Security

• *Security Enhancements:*

Changed

• Strengthen server-side validation of uploaded file types to block disallowed files

3.3.33 7 Sep 2026 2 fixed

Fixed

• Fix File Upload merge tag suffix variants not populating during PDF export or retriggered emails
• Fix fatal error when uploading files to Amazon S3

3.3.32 21 Jul 2026 1 fixed

Fixed

• Fix download links in notification emails returning blank screen for server-stored files

3.3.31 20 Jul 2026 13 fixed1 security

Fixed

• Fix file upload button background staying white after file selection
• Fix submit button not reliably blocked during active file upload
• Fix "Delete" attachment button not translated in bundled translations
• Fix files >5MB not appearing in File Uploads admin after S3 background upload
• Fix file persisting on server when "Save to Server" disabled with Google Drive and file rename
• Fix external service upload URL showing server path in submissions
• Fix file extensions not in WordPress MIME registry failing upload when explicitly allowed
• Fix date shortcodes using server timezone instead of WordPress site timezone
• *Workflow:*
• Fix PHP 8.4/8.5 deprecation notices in vendored libraries
• *Security Enhancements:*
• Protect admin notices from reflected XSS via query parameters
• Require administrator capability for external file URL access

Security

• Sanitize uploaded filenames to block stored XSS

3.3.30 2 Jul 2026 4 fixed

Fixed

• Fix "temp file does not exist" error on form re-submission after validation error
• *Security Enhancements:*
• Protect debug log REST endpoints from unauthenticated access
• Block arbitrary file read via email attachment path traversal

3.3.29 20 May 2026 8 fixed

Fixed

• Fix strict comparison for PHP 7.4 file extension validation
• Fix repeater file upload fields not saving all file sets
• Fix save settings translation call timing
• Suppress undefined array key warnings for upload_types
• Fix filename merge tag not appearing on payment gateways
• *Security Enhancements:*
• Protect against unauthenticated file uploads
• Protect against XSS in AJAX response, admin submissions, and merge tags

3.3.28 8 Apr 2026 2 fixed1 security

Fixed

• Fix injection and CSRF in uploads table
• Fix reflected XSS in OAuth2 admin

Security

• *Security Enhancements:*

3.3.27 16 Mar 2026 1 new3 fixed

New

• Add aria-labelledby to file upload button for accessibility

Fixed

• Fix cancel button clearing all form field data
• *Security Enhancements:*
• Block destination filename whitelist bypass in file upload

3.3.26 9 Feb 2026 3 fixed

Fixed

• Reconstruct file upload data for retriggered emails
• *Security Enhancements:*
• Block executable file variants with expanded extension blacklist

3.3.25 26 Jan 2026 2 fixed1 security

Fixed

• Fix submit button state during active file uploads
• Make file type validation case-insensitive

Security

• Sanitize uploaded file paths (security fix)

3.3.24 19 Jan 2026 3 fixed

Fixed

• Ensure translations load at correct time
• Prevent Google Drive disconnection
• Correct AWS namespacing

2025 2 versions

3.3.23 7 Jul 2025 1 fixed1 removed

Fixed

• Accessibility and psr-12

Removed

• Remove admin notice and settings for logger

3.3.22 30 Jan 2025 1 improved

Improved

• Update to work with WordPress 6.7 translations.

2024 5 versions

3.3.21 10 Dec 2024 1 improved

Improved

• Update Google scope for more specific authorization

3.3.20 15 Jul 2024 3 fixed

Fixed

• Automatically allow equivalent file extensions
• Allow file extensions with extra whitespace in list
• Correct errant library class names

3.3.19 24 Jun 2024 1 fixed

Fixed

• Ensure WP allowed files list is honored

3.3.18 31 May 2024 1 changed

Changed

• Migrate Google and AWS libraries internally

3.3.17 1 May 2024 1 fixed1 removed

Fixed

• Prevent upload of file types not allowed by WordPress unless explicitly specified

Removed

• Remove deprecated folder for sunset versions of Ninja Forms

2023 2 versions

3.3.16 6 Jun 2023 1 fixed

Fixed

• Correct errant namespace scoping for autoloading

3.3.15 17 May 2023 1 improved1 fixed

Improved

• Update plugin build process

Fixed

• Ensure fieldset repeater functionality

2022 1 version

3.3.14 7 Mar 2022 1 fixed

Fixed

• Fix PHP 8 error in which curly braces are no longer supported

2021 3 versions

3.3.13 30 Nov 2021 4 fixed

Fixed

• Escape filename to prevent XSS. Credit: Nuno Correia (Blaze Security) for responsibly reporting issue
• Fix 'required parameter follows optional' error
• Other Enhancements *
• Automate plugin build

3.3.12 1 Aug 2021 1 new3 fixed

New

• French translations added

Fixed

• File Upload fields not working in Repeater Fieldsets
• Some string translations not loaded correctly
• File saved to media library even if save to server is turned off

3.3.11 24 Mar 2021 1 new1 improved2 fixed

New

• Tested up to WordPress 5.7

Improved

• Compatibility with PHP 8

Fixed

• PHP notices when using PHP 8
• Cyrillic characters are removed from file names when uploading to Google Drive

2020 13 versions

3.3.10 27 Oct 2020 1 new3 fixed

New

• Advanced setting in the External File Upload action to upload files in the background

Fixed

• Fix fatal error 'Uncaught NF_FU_VENDORGoogle_Service_Exception' when Google Drive connection is changed when background uploading a large file
• Fix images not appearing when using the embed mergetag in PDFs
• Fix files with cyrillic characters in the filename being uploaded as unnamed-file

3.3.9 6 Oct 2020 3 fixed

Fixed

• Fix uploads taking a long time when renaming file directories
• Fix File Upload mergetags not available in PDFs created at form submission time
• Fix cancel button not using label defined in field display settings

3.3.8 7 Sep 2020 1 improved

Improved

• Compatibility with the PDF Submissions addon

3.3.7 10 Aug 2020 1 fixed

Fixed

• Fix background upload jobs duplicating files when multiple file upload fields on a form

3.3.6 4 Aug 2020 3 improved2 fixed

Improved

• Tested on WordPress 5.5
• Default Amazon S3 ACL set to private
• Filter 'ninja_forms_uploads_default_region' added for the default region for S3 clients

Fixed

• Fix uploading of any size file in the background to external services
• Fix background uploading not working if memory_limit defined in Gigabytes

3.3.5 25 Jun 2020 1 new1 improved3 fixed

New

• Setting to make the URLs to files upload to external service providers accessible to non-logged in users

Improved

• Updated jQuery File Upload library to v10.30.1.

Fixed

• Fix Google Drive file preview URL not working
• Fix cancel button doesn't show to allow clearing upload errors
• Fix files with non UTF8 characters not reloaded when using the Save Progress addon

3.3.4 10 Jun 2020 2 fixed

Fixed

• Fix mergetags variations not rendering the correct value
• Fix external file url redirecting to site admin home if the service is no longer connected

3.3.3 26 May 2020 1 new7 fixed

New

• Button to cancel a file upload, or clear an error after a failed upload

Fixed

• File upload links being stripped from emails and success messages
• Fatal error when uploading multiple files to Google Drive and renaming the file names
• Required field validation error shows when the 'Select Files' button clicked
• Missing file upload when submitting a form that had previously been saved with the Save Progress addon
• Multiple file upload URLs appearing as one large broken link in emails
• PHP notices about mergetag values when saving a form
• Browse uploads table losing form filter when paginating or sorting

3.3.2 23 Mar 2020 2 new3 fixed

New

• Added new filter 'ninja_forms_uploads_tmp_dir' to change the temp directory for uploads
• Added external service $slug parameter to the filter 'ninja_forms_uploads_should_background_upload'

Fixed

• Some large files corrupted when uploading to Dropbox
• Error not displayed when uploading a file larger than the maximum defined in settings
• Undefined variable: mime_types_whitelist

3.3.1 9 Mar 2020 1 security

Security

• Security flaw which could allow files with blacklisted file extensions to be uploaded

3.3.0 2 Mar 2020 2 new2 fixed

New

• Files larger than the server maximum upload size can now be uploaded
• Large files uploaded to external services in the background, no longer holding up form submission

Fixed

• Uploads and External settings page can't be saved due to missing nonce
• File uploaded to multiple external services being uploaded with the incorrect timestamp filename prefix

3.2.6 21 Jan 2020 1 fixed

Fixed

• Unknown upload error when the same form appears twice on a page

3.2.5 16 Jan 2020 1 fixed

Fixed

• Fatal error: Cannot redeclare pcntl_signal() on some install