Skip to content
PluginCanary

Contact Form Plugin

by GhozyLab · 2,000+ active installs · Checked 3 Nov 2026
Avoid1 Critical

Avoid: vulnerability published 1 Mar 2017 still has no fix after 14 days.

39/ 100 Canary Score

Capped at 39: a vulnerability has no patch.

Sub-scores for Contact Form Plugin
Ownership100
Maintenance100
Security20
Support70
Reputation70

How the score works

Quick answers

Is Contact Form Plugin still maintained?
Yes. Last release 2 Sep 2026, 4 releases in the last 24 months. 2 Sep 2026 · wordpress.org
Who owns Contact Form Plugin, and has it changed hands?
No change recorded. Main committer GhozyLab since Apr 2015. 3 Nov 2026 · SVN log
Was Contact Form Plugin removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is Contact Form Plugin safe?
No. 1 known vulnerability has no fix in the current version. 9 Jun 2025 · Wordfence Intelligence
Is the latest Contact Form Plugin update safe to install?
No ownership change before 1.1.33. No one-star spike after it. 1 Sep 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • CriticalSEC-2Vulnerability published 1 Mar 2017 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.15 Mar 2017Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
GhozyLab5 Apr 2015 to 2 Sep 2026, 332 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
2 months ago
Releases, 24 months
4
Tested up to
7.1 current
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for Contact Form Plugin
Q1 20241
Q2 20240
Q3 20240
Q4 20241
Q1 20250
Q2 20252
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20261
Q4 20260

Last release 2 Sep 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 2.8.

Rating distribution
5 star6
4 star0
3 star2
2 star2
1 star7

Security record

2 vulnerabilities in 24 months (4 on record), 1 with no fix in the current version.

PublishedIssueCVSSAffectedFixed inDays to patch
1 Mar 2017Contact Form Plugin <= 4.0.1 - Stored Cross-Site Scripting6.4<= 4.0.1No fixn/a
Show 3 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
9 Jun 2025Easy Contact Form Lite <= 1.1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 1.1.281.1.294
23 Feb 2025Contact Form Plugin <= 1.1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 1.1.251.1.2743
12 Apr 2024Easy Contact Form Lite <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 1.1.231.1.25188

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Contact Form Plugin
4 May 202682
11 May 2026126
18 May 2026140
25 May 2026134
1 Jun 2026101
8 Jun 2026116
15 Jun 202698
22 Jun 202686
29 Jun 2026104
6 Jul 202695
13 Jul 2026100
20 Jul 202697
27 Jul 2026112
3 Aug 2026133
10 Aug 2026113
17 Aug 2026134
24 Aug 2026162
31 Aug 20261,158
7 Sep 2026212
14 Sep 2026223
21 Sep 2026189
28 Sep 2026212
5 Oct 2026188
12 Oct 2026239
19 Oct 2026270
26 Oct 2026215
2 Nov 202664

Weekly downloads over the last 4 weeks are 8% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Online FormsScore 91 · 20,000+Zoho FormsScore 91 · 10,000+RTMFormScore 90 · 30,000+Contact Form by BestWebSoftScore 90 · 30,000+WPZOOM FormsScore 90 · 10,000+

Facts

Version1.1.33
AuthorGhozyLab
Added5 Apr 2015
Last updated2 Sep 2026
Active installs2,000+
Requires WordPress3.3
Tested up to7.1.4
Requires PHPnot stated
Categorynot stated
Tagsform, form plugin, contact form, form builder, wordpress form

Other plugins by this author: Gallery Lightbox, Image Slider, Gallery - Photo Albums Plugin, Web Icons, Image Carousel, Gallery for Social Photo, Easy Notify Lite, WP Composer - The Easiest Page Builder, Luvre - WordPress Media Library Folders

Questions

Is Contact Form Plugin still maintained?

Yes. Last release 2 Sep 2026, 4 releases in the last 24 months.

Who owns Contact Form Plugin, and has it changed hands?

No change recorded. Main committer GhozyLab since Apr 2015.

Was Contact Form Plugin removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is Contact Form Plugin safe?

No. 1 known vulnerability has no fix in the current version.

Is the latest Contact Form Plugin update safe to install?

No ownership change before 1.1.33. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue