Skip to content
PluginCanary

BuddyForms

by Themekraft · 800+ active installs · Checked 3 Nov 2026
Healthy2 Warnings

Healthy: vulnerability published 28 Oct 2026, fixed in 2.10.1.

81/ 100 Canary Score
Sub-scores for BuddyForms
Ownership100
Maintenance100
Security60
Support70
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.10.1. Update to version 2.10.1 or later.28 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 28 Oct 2026, fixed in 2.10.3. Update to version 2.10.3 or later.28 Oct 2026Evidence
  • InfoSEC-37 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
themekraft2 Nov 2026 to 2 Nov 2026, 1 commits

New committer themekraft made a first commit on 2 Nov 2026.

Maintenance

Last release
yesterday
Releases, 24 months
1
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for BuddyForms
Q1 20240
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20261

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
28 Oct 2026BuddyForms <= 2.10.0 - Missing Authorization4.3<= 2.10.02.10.1n/a
28 Oct 2026BuddyForms <= 2.10.2 - Unauthenticated Information Exposure5.3<= 2.10.22.10.3n/a
9 Sep 2026Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.9.0 - Missing Authorization5.3<= 2.9.0Not affectedn/a
19 Oct 2025BuddyForms <= 2.9.0 - Missing Authorization5.3<= 2.9.0Not affectedn/a
4 Apr 2025BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion8.8<= 2.8.17Not affectedn/a
21 Feb 2025Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode6.4<= 2.8.152.8.16n/a
30 Jan 2025Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.8.132.8.14n/a
30 Sep 2024BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting4.4<= 2.8.122.8.13n/a
13 Sep 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation8.8<= 2.8.112.8.12n/a
4 Jun 2024BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness6.5<= 2.8.92.8.10n/a
22 Apr 2024BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery9.3<= 2.8.82.8.9n/a
25 Mar 2024BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page6.1<= 2.8.52.8.6n/a
6 Mar 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization4.3<= 2.8.72.8.8n/a
6 Mar 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload7.5<= 2.8.72.8.8n/a
6 Mar 2024Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion8.2<= 2.8.72.8.8n/a
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.1<= 2.8.22.8.3n/a
11 May 2023Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.8.12.8.2n/a
20 Feb 2023BuddyForms <= 2.7.7 - PHAR Deserialization8.8<= 2.7.72.7.8n/a
27 Oct 2022BuddyForms <= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting6.4<= 2.7.22.7.3n/a
26 Jun 2022Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.6.9 - Cross-Site Scripting6.1<= 2.6.92.6.10n/a
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 2.6.32.6.3n/a
25 Feb 2019Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update8.8< 2.3.22.3.2n/a
9 Nov 2018Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 - SQL Injection9.8<= 2.2.72.2.8n/a

Source: Wordfence Intelligence.

Reputation

Lifetime rating 4.8 from 180 ratings. Quarterly trends appear as new reviews arrive.

Rating distribution
5 star163
4 star5
3 star5
2 star4
1 star3

Momentum

800+ active installs. History builds with each weekly snapshot.

Momentum history builds with each snapshot.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Database Addon For WPForms ( wpforms entries ) - WPFormsDBScore 92 · 20,000+Cool FormKit Lite - Advanced Form Builder for ElementorScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Multi Step for Contact Form 7Score 91 · 10,000+Smart Grid-Layout Design for Contact Form 7Score 91 · 10,000+

Facts

Version2.10.6
AuthorThemekraft
Added28 Oct 2016
Last updated2 Nov 2026
Active installs800+
Requires WordPress5.9
Tested up to7.1.4
Requires PHP7.4
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, custom form, form builder, registration, User Registration

Other plugins by this author: BuddyDrive, TK Google Fonts, BuddyPress Integration for WooCommerce, BuddyPress & BuddyBoss Member Profile Forms, All in One Invite Codes, BuddyForms Advanced Custom Fields, BuddyForms Ultimate Member, BuddyPress xProfile Checkout Manager for WooCommerce, BuddyForms Moderation ( Former: Review Logic ), BuddyForms Custom Login, BuddyForms Form Elements for WooCommerce

Questions

Is BuddyForms still maintained?

BuddyForms was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is BuddyForms safe?

BuddyForms has no open unpatched vulnerabilities on record. 7 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns BuddyForms?

The wordpress.org author is Themekraft. Recent committers: themekraft. New committer themekraft made a first commit on 2 Nov 2026.

What can I use instead of BuddyForms?

Plugins in the same category with a higher Canary Score: Database Addon For WPForms ( wpforms entries ) - WPFormsDB, Cool FormKit Lite - Advanced Form Builder for Elementor, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Multi Step for Contact Form 7, Smart Grid-Layout Design for Contact Form 7.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue