Skip to content
PluginCanary

WP-FormAssembly

by FormAssembly · 2,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 19 May 2026, 4 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for WP-FormAssembly
Ownership100
Maintenance85
Security95
Support70
Reputation70

How the score works

Quick answers

Is WP-FormAssembly still maintained?
Yes. Last release 19 May 2026, 4 releases in the last 24 months. 19 May 2026 · wordpress.org
Who owns WP-FormAssembly, and has it changed hands?
No change recorded. Main committer veerwest since Mar 2015. 3 Nov 2026 · SVN log
Was WP-FormAssembly removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP-FormAssembly safe?
5 known vulnerabilities, all fixed (latest in 3.0.0). Not on the exploited list. 17 Feb 2025 · Wordfence Intelligence
Is the latest WP-FormAssembly update safe to install?
No ownership change before 3.0.3. No one-star spike after it. 19 May 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
veerwest25 Mar 2015 to 19 May 2026, 57 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
6 months ago
Releases, 24 months
4
Tested up to
7.0 vs 7.1
Requires PHP
not stated supported 8.2+
Releases per quarter
Releases per quarter for WP-FormAssembly
Q1 20241
Q2 20240
Q3 20240
Q4 20240
Q1 20251
Q2 20252
Q3 20250
Q4 20250
Q1 20260
Q2 20261
Q3 20260
Q4 20260

Last release 19 May 2026. Tested up to 7.0, 1 major version behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 4.0.

Rating distribution
5 star2
4 star0
3 star0
2 star1
1 star0

Security record

1 vulnerability in 24 months (5 on record), patched (latest fixed in 3.0.0).

Show 5 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
17 Feb 2025WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.0.113.0.042
16 Apr 2024WP-FormAssembly <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 2.0.102.0.11Patched before disclosure
2 May 2023WP-FormAssembly <= 2.0.8 - Limited Server Side Request Forgery via 'formassembly' shortcode5< 2.0.92.0.91
18 Apr 2023WP-FormAssembly <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4<= 2.0.72.0.8Patched before disclosure
23 Nov 2022WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read6.5<= 2.0.52.0.672

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP-FormAssembly
4 May 2026100
11 May 2026145
18 May 20261,267
25 May 2026428
1 Jun 2026372
8 Jun 2026242
15 Jun 2026201
22 Jun 2026173
29 Jun 2026238
6 Jul 2026253
13 Jul 2026280
20 Jul 2026239
27 Jul 2026243
3 Aug 2026258
10 Aug 2026220
17 Aug 2026195
24 Aug 2026219
31 Aug 2026165
7 Sep 2026184
14 Sep 2026324
21 Sep 2026243
28 Sep 2026240
5 Oct 2026295
12 Oct 2026551
19 Oct 2026620
26 Oct 2026529
2 Nov 202686

Weekly downloads over the last 4 weeks are 45% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Online FormsScore 91 · 20,000+Zoho FormsScore 91 · 10,000+RTMFormScore 90 · 30,000+Contact Form by BestWebSoftScore 90 · 30,000+WPZOOM FormsScore 90 · 10,000+

Facts

Version3.0.3
AuthorFormAssembly
Added25 Mar 2015
Last updated19 May 2026
Active installs2,000+
Requires WordPress4.0.0
Tested up to7.0.8
Requires PHPnot stated
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms

Questions

Is WP-FormAssembly still maintained?

Yes. Last release 19 May 2026, 4 releases in the last 24 months.

Who owns WP-FormAssembly, and has it changed hands?

No change recorded. Main committer veerwest since Mar 2015.

Was WP-FormAssembly removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP-FormAssembly safe?

5 known vulnerabilities, all fixed (latest in 3.0.0). Not on the exploited list.

Is the latest WP-FormAssembly update safe to install?

No ownership change before 3.0.3. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue