Skip to content
PluginCanary

FormCraft

FormCraft - Form Builder
by Formcrafts · 2,000+ active installs · Checked 3 Nov 2026
Avoid3 Criticals1 Warning

Avoid: no release in 27 months (last release 22 Jul 2024).

39/ 100 Canary Score

Capped at 39: a vulnerability has no patch.

Sub-scores for FormCraft
Ownership100
Maintenance0
Security40
Support70
Reputation70

How the score works

Quick answers

Is FormCraft still maintained?
No. Last release 22 Jul 2024, over 2 years ago. 22 Jul 2024 · wordpress.org
Who owns FormCraft, and has it changed hands?
No change recorded. 3 Nov 2026 · SVN log
Was FormCraft removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is FormCraft safe?
No. 2 known vulnerabilities have no fix in the current version. 7 Aug 2024 · Wordfence Intelligence
Is the latest FormCraft update safe to install?
Not enough data. No release date on record for the current version. Release history

Active signals

Facts we detected, with links to the source.

  • CriticalMNT-1No release in 27 months (last release 22 Jul 2024). Plan a replacement if the plugin is important to your site.22 Jul 2025Evidence
  • CriticalSEC-2Vulnerability published 5 Jun 2023 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.19 Jun 2023Evidence
  • CriticalSEC-2Vulnerability published 28 Feb 2022 still has no fix after 14 days. Disable or replace the plugin. No fix has been released.14 Mar 2022Evidence
  • WarningMNT-2Tested up to WordPress 6.6.11, 5 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
[email protected]7 Mar 2015 to 22 Jul 2024, 47 commits

1 committer recorded. No ownership change since 2015.

Maintenance

Last release
2 years ago
Releases, 24 months
0
Tested up to
6.6 vs 7.1
Requires PHP
not stated supported 8.2+

Last release 22 Jul 2024. Tested up to 6.6, 5 major versions behind WordPress 7.1. Release history builds as we see new versions.

Reputation

Last 90 days: no reviews. Lifetime: 4.5.

Rating distribution
5 star44
4 star1
3 star1
2 star2
1 star5

Security record

10 vulnerabilities on record, 2 with no fix in the current version.

PublishedIssueCVSSAffectedFixed inDays to patch
5 Jun 2023FormCraft Premium <= 3.9.6 - Authenticated(Administrator+) SQL Injection6.6<= 3.9.5No fixn/a
28 Feb 2022Formcraft3 <= 3.8.27 - Server Side Request Forgery9.1< 3.8.28No fixn/a
Show 8 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
7 Aug 2024FormCraft <= 1.2.10 - Missing Authorization4.3<= 1.2.101.2.11n/a
16 Nov 2023FormCraft <= 1.2.7 - Missing Authorization via formcraft_nag_update5.3<= 1.2.71.2.8n/a
2 Aug 2023FormCraft <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.2.61.2.7n/a
19 Apr 2023FormCraft <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode6.4<= 1.2.91.2.10n/a
16 May 2022FormCraft Basic <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting5.5< 1.2.61.2.6n/a
26 Feb 2019FormCraft <= 1.2.1 - Cross-Site Request Forgery8.8<= 1.2.11.2.2n/a
26 Feb 2019FormCraft <= 1.2.1 - Cross-Site Request Forgery8.8< 1.2.21.2.2n/a
5 Jul 2017FormCraft Basic 1.0.5 - SQL Injection via id Parameter9.81.0.51.0.6n/a

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

Support history appears after our first snapshots of the forum counts.

Momentum

2,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for FormCraft
4 May 202639
11 May 2026110
18 May 2026119
25 May 2026104
1 Jun 202677
8 Jun 202699
15 Jun 202686
22 Jun 202655
29 Jun 202680
6 Jul 202677
13 Jul 2026104
20 Jul 202696
27 Jul 2026104
3 Aug 2026128
10 Aug 2026115
17 Aug 2026112
24 Aug 2026107
31 Aug 2026104
7 Sep 2026102
14 Sep 2026116
21 Sep 2026153
28 Sep 2026139
5 Oct 2026148
12 Oct 2026144
19 Oct 2026222
26 Oct 2026193
2 Nov 202668

Weekly downloads over the last 4 weeks are 41% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Online FormsScore 91 · 20,000+Zoho FormsScore 91 · 10,000+RTMFormScore 90 · 30,000+Contact Form by BestWebSoftScore 90 · 30,000+WPZOOM FormsScore 90 · 10,000+

Facts

Version1.2.11
AuthorFormcrafts
Added7 Mar 2015
Last updated22 Jul 2024
Active installs2,000+
Requires WordPress3.6
Tested up to6.6.11
Requires PHPnot stated
CategoryForms & Data Collection > Form Builders & Creators
Tagssurvey, form builder, contact form 7, contact form builder

Other plugins by this author: reCaptcha Add-On for FormCraft, MailChimp Add-On for FormCraft, Mailster Add-On for FormCraft, MailPoet Add-On for FormCraft, GetResponse Add-On for FormCraft, Campaign Monitor Add-On for FormCraft, WP REST API Filter Fields

Questions

Is FormCraft still maintained?

No. Last release 22 Jul 2024, over 2 years ago.

Who owns FormCraft, and has it changed hands?

No change recorded.

Was FormCraft removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is FormCraft safe?

No. 2 known vulnerabilities have no fix in the current version.

Is the latest FormCraft update safe to install?

Not enough data. No release date on record for the current version.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue