Black Friday: 30% OFF on all plans, applied automatically at checkout View plans
1,177 sites with automatic updates See plans
Log in Cart

Ninja Forms File Uploads Changelog

Every recorded version, newest first, with what changed in each one.

Latest 3.3.37 · Nov 2, 202615 versionsSince Mar 2021

2026 · 12 versions

  1. 3.3.37

    Latest
    6 fixes1 security3 changes
    Fixed
    • Bug Fixes
    • fix uploaded files and their File Uploads entries being left behind when a submission is permanently deleted
    • fix empty folders being left in the uploads folder after files are removed because "Save to Server" is off
    • fix email merge tags linking to an uploaded file that was not saved anywhere
    • fix files from a submission turned down by validation, a unique-field match or a submission limit being kept and listed in File Uploads
    • fix PDF Submissions exports including files uploaded with other submissions
    Security
    • Security Enhancements
    Changes
    • harden handling of uploaded file data during form submission
    • bind stored uploads to their form and field in merge tags, Zapier and submission records
    • protect public external file links with a per-file access key

  2. 3.3.36

    6 fixes
    Fixed
    • Bug Fixes
    • fix "maximum file size" error message always appearing in English on translated sites
    • fix fatal error when a large Amazon S3 upload fails in the background; the upload is now retried, then marked as failed
    • fix only the first file uploading when several files are dropped onto a File Upload field
    • fix Submit becoming available before every selected file has finished uploading
    • fix an upload in progress being shown as an error

  3. 3.3.35

    1 improvement10 fixes3 changes
    Improved
    • Enhancements
    Fixed
    • Bug Fixes
    • fix uploaded files being deleted when their external storage service is disconnected and "Save to Server" is off
    • fix files not reaching Google Drive when a Custom Directory is set
    • fix fatal error when a Google Drive upload fails; the file is now kept on the server and marked as failed in the admin
    • fix Google Drive connection being dropped on temporary network or proxy errors
    • fix bulk delete on the File Uploads screen failing with "The link you followed has expired"
    • fix maximum file count showing an error and blocking submission when the allowed number of files is selected
    • fix "Attach File Uploads" email option not appearing until the form is saved and reloaded
    • fix PHP warnings logged when a File Upload field in a repeatable fieldset is left empty
    • fix early translation loading notice on WordPress 6.7+ when Amazon S3 is connected
    Changes
    • allow File Upload fields inside repeatable fieldsets to be sent to external storage
    • show an admin warning when an external storage service is disconnected automatically
    • show the Google Drive folder each uploaded file was saved to

  4. 3.3.34

    6 fixes1 security1 change
    Fixed
    • Bug Fixes
    • fix chunked uploads being overwritten by a single chunk when a chunk request is repeated
    • fix HEIC/HEIF photo uploads failing on iPhone Safari due to a content/extension mismatch
    • fix uploaded files in repeatable fieldsets not reaching the email or submission when more than one fieldset is added
    • fix file size validation not enforcing PHP upload limits, allowing truncated files through
    • fix email action with attachments disabled inheriting another action's attachment settings when both send to the same recipient
    Security
    • Security Enhancements
    Changes
    • strengthen server-side validation of uploaded file types to block disallowed files

  5. 3.3.33

    3 fixes
    Fixed
    • Bug Fixes
    • fix File Upload merge tag suffix variants not populating during PDF export or retriggered emails
    • fix fatal error when uploading files to Amazon S3

  6. 3.3.32

    2 fixes
    Fixed
    • Bug Fixes
    • fix download links in notification emails returning blank screen for server-stored files

  7. 3.3.31

    10 fixes1 security4 changes
    Fixed
    • Bug Fixes
    • fix file upload button background staying white after file selection
    • fix submit button not reliably blocked during active file upload
    • fix "Delete" attachment button not translated in bundled translations
    • fix files >5MB not appearing in File Uploads admin after S3 background upload
    • fix file persisting on server when "Save to Server" disabled with Google Drive and file rename
    • fix external service upload URL showing server path in submissions
    • fix file extensions not in WordPress MIME registry failing upload when explicitly allowed
    • fix date shortcodes using server timezone instead of WordPress site timezone
    • fix PHP 8.4/8.5 deprecation notices in vendored libraries
    Security
    • Security Enhancements
    Changes
    • Workflow
    • protect admin notices from reflected XSS via query parameters
    • sanitize uploaded filenames to block stored XSS
    • require administrator capability for external file URL access

  8. 3.3.30

    2 fixes1 security2 changes
    Fixed
    • Bug Fixes
    • fix "temp file does not exist" error on form re-submission after validation error
    Security
    • Security Enhancements
    Changes
    • protect debug log REST endpoints from unauthenticated access
    • block arbitrary file read via email attachment path traversal

  9. 3.3.29

    5 fixes1 security3 changes
    Fixed
    • Bug Fixes
    • fix strict comparison for PHP 7.4 file extension validation
    • fix repeater file upload fields not saving all file sets
    • fix save settings translation call timing
    • fix filename merge tag not appearing on payment gateways
    Security
    • Security Enhancements
    Changes
    • suppress undefined array key warnings for upload_types
    • protect against unauthenticated file uploads
    • protect against XSS in AJAX response, admin submissions, and merge tags

  10. 3.3.28

    2 fixes1 security
    Fixed
    • Fix injection and CSRF in uploads table
    • Fix reflected XSS in OAuth2 admin
    Security
    • Security Enhancements

  11. 3.3.27

    1 new2 fixes1 security1 change
    New
    • add aria-labelledby to file upload button for accessibility
    Fixed
    • Bug Fixes
    • fix cancel button clearing all form field data
    Security
    • Security Enhancements
    Changes
    • block destination filename whitelist bypass in file upload

  12. 3.3.26

    2 improvements11 fixes1 security2 removed24 changes
    Improved
    • Update to work with WordPress 6.7 translations.
    • Update Google scope for more specific authorization
    Fixed
    • Bug Fixes
    • Bug Fixes
    • fix submit button state during active file uploads
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    • Bug Fixes
    Security
    • Security Enhancements
    Removed
    • Remove admin notice and settings for logger
    • Remove deprecated folder for sunset versions of Ninja Forms
    Changes
    • reconstruct file upload data for retriggered emails
    • block executable file variants with expanded extension blacklist
    • = 3.3.25 (January 26, 2026)
    • make file type validation case-insensitive
    • sanitize uploaded file paths (security fix)
    • = 3.3.24 (January 19, 2026)
    • ensure translations load at correct time
    • prevent Google Drive disconnection
    • correct AWS namespacing
    • = 3.3.23 (July 7 2025)
    • Accessibility and psr-12
    • = 3.3.22 (30 January 2025)
    • = 3.3.21 (10 December 2024)
    • = 3.3.20 (15 July 2024)
    • Automatically allow equivalent file extensions
    • Allow file extensions with extra whitespace in list
    • Correct errant library class names
    • = 3.3.19 (24 June 2024)
    • Ensure WP allowed files list is honored
    • = 3.3.18 (31 May 2024)
    • Migrate Google and AWS libraries internally
    • = 3.3.17 (01 May 2024)
    • prevent upload of file types not allowed by WordPress unless explicitly specified
    • = 3.3.16 (06 June 2023)

2021 · 3 versions

  1. 3.3.13

    1 fix3 changes
    Fixed
    • Fix 'required parameter follows optional' error
    Changes
    • Escape filename to prevent XSS. Credit: Nuno Correia (Blaze Security) for responsibly reporting issue
    • Other Enhancements
    • Automate plugin build

  2. 3.3.12

    4 changes
    Changes
    • French translations added
    • File Upload fields not working in Repeater Fieldsets
    • Some string translations not loaded correctly
    • File saved to media library even if save to server is turned off

  3. 3.3.11

    1 improvement3 changes
    Improved
    • Compatibility with PHP 8
    Changes
    • Tested up to WordPress 5.7
    • PHP notices when using PHP 8
    • Cyrillic characters are removed from file names when uploading to Google Drive

Changelog published by the developer, in their original language.