Skip to content
PluginCanary

Forminator Forms - Contact Form, Payment Form & Custom Form Builder

by WPMU DEV - Your All-in-One WordPress Platform · 600,000+ active installs · Checked 3 Nov 2026
Healthy30 Warnings

Healthy: vulnerability published 30 Oct 2026, fixed in 1.58.0.

85/ 100 Canary Score
Sub-scores for Forminator Forms - Contact Form, Payment Form & Custom Form Builder
Ownership100
Maintenance100
Security60
Support82
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 30 Oct 2026, fixed in 1.58.0. Update to version 1.58.0 or later.30 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 29 Oct 2026, fixed in 1.55.1. Update to version 1.55.1 or later.29 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 1.58.2. Update to version 1.58.2 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 15 Oct 2026, fixed in 1.58.2. Update to version 1.58.2 or later.15 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 12 Oct 2026, fixed in 1.58.1. Update to version 1.58.1 or later.12 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 1.58.0. Update to version 1.58.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 1.58.0. Update to version 1.58.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 1.58.0. Update to version 1.58.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Oct 2026, fixed in 1.58.0. Update to version 1.58.0 or later.8 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 1.57.3. Update to version 1.57.3 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 2 Oct 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.2 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 30 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.30 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 21 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.21 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 1.57.3. Update to version 1.57.3 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 18 Sep 2026, fixed in 1.57.2.1. Update to version 1.57.2.1 or later.18 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 28 Aug 2026, fixed in 1.57.1. Update to version 1.57.1 or later.28 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 28 Aug 2026, fixed in 1.57.0.7. Update to version 1.57.0.7 or later.28 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 28 Aug 2026, fixed in 1.57.2. Update to version 1.57.2 or later.28 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 27 Aug 2026, fixed in 1.57.0.2. Update to version 1.57.0.2 or later.27 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 27 Aug 2026, fixed in 1.57.0.5. Update to version 1.57.0.5 or later.27 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 24 Aug 2026, fixed in 1.57.0.1. Update to version 1.57.0.1 or later.24 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 24 Aug 2026, fixed in 1.57.0.3. Update to version 1.57.0.3 or later.24 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 19 Aug 2026, fixed in 1.57.1. Update to version 1.57.1 or later.19 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 17 Aug 2026, fixed in 1.56.2. Update to version 1.56.2 or later.17 Aug 2026Evidence
  • WarningSEC-1Vulnerability published 15 Aug 2026, fixed in 1.55.1. Update to version 1.55.1 or later.15 Aug 2026Evidence
  • InfoSEC-352 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
jdailey4 Sep 2018 to 19 Mar 2020, 26 commits
alerzhus25 Sep 2018 to 21 Jul 2021, 47 commits
rickjc897 May 2020 to 4 Feb 2021, 9 commits
vanyukov11 Mar 2021 to 2 Nov 2021, 2 commits
Dency23 Aug 2021 to 2 Sep 2024, 52 commits
ivansvyrskyi7 Mar 2024 to 2 Nov 2026, 265 commits
panoslyrakis10 Jul 2024 to 12 Aug 2026, 7 commits

7 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
73
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter for Forminator Forms - Contact Form, Payment Form & Custom Form Builder
Q1 20242
Q2 20243
Q3 20246
Q4 20246
Q1 202510
Q2 20259
Q3 20255
Q4 20255
Q1 20265
Q2 20269
Q3 202622
Q4 20266

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

82% of 68 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
30 Oct 2026Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter7.5<= 1.57.3.11.58.00
29 Oct 2026Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata6.5<= 1.55.0.21.55.10
15 Oct 2026Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block6.5<= 1.58.11.58.20
15 Oct 2026Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags6.5<= 1.58.11.58.20
12 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Missing Authorization5.3<= 1.58.01.58.10
8 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Privilege Escalation7.3<= 1.57.31.58.00
8 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Missing Authorization5.3<= 1.57.31.58.00
8 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting7.2<= 1.57.31.58.00
8 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery4.3<= 1.57.31.58.00
2 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization5.3<= 1.57.21.57.30
2 Oct 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Unauthenticated Payment Bypass5.3<= 1.57.21.57.2.10
30 Sep 2026Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter7.2<= 1.57.21.57.2.10
30 Sep 2026Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field7.2<= 1.57.21.57.2.10
21 Sep 2026Forminator Forms <= 1.57.2.0 - Missing Authorization4.3<= 1.57.2.01.57.2.10
21 Sep 2026Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass5.3<= 1.57.2.01.57.2.10
21 Sep 2026Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection5.3<= 1.57.2.01.57.2.10
21 Sep 2026Forminator Forms <= 1.57.2.0 - Missing Authorization5.3<= 1.57.2.01.57.2.10
18 Sep 2026Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter9.1<= 1.57.21.57.30
18 Sep 2026Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection6.6<= 1.57.2.01.57.2.10
18 Sep 2026Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation7.2<= 1.57.2.01.57.2.10
28 Aug 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation7.3< 1.57.11.57.10
28 Aug 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation6.3< 1.57.0.71.57.0.70
28 Aug 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass5.3<= 1.57.11.57.20
27 Aug 2026Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field7.2<= 1.57.0.11.57.0.20
27 Aug 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution7.2< 1.57.0.51.57.0.50

Source: Wordfence Intelligence.

Reputation

Average rating stayed at 4.9 between Q3 2026 and Q4 2026.

Rating distribution
5 star1993
4 star68
3 star26
2 star12
1 star45

Momentum

600,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for Forminator Forms - Contact Form, Payment Form & Custom Form Builder
4 May 202619,125
11 May 2026219,289
18 May 202659,157
25 May 2026210,716
1 Jun 202643,033
8 Jun 202630,813
15 Jun 2026199,491
22 Jun 202651,173
29 Jun 2026207,856
6 Jul 202676,712
13 Jul 202642,870
20 Jul 202629,526
27 Jul 2026378,694
3 Aug 202684,864
10 Aug 2026226,880
17 Aug 2026260,142
24 Aug 2026217,808
31 Aug 202656,448
7 Sep 202633,569
14 Sep 2026228,401
21 Sep 202659,647
28 Sep 202630,958
5 Oct 2026210,749
12 Oct 2026389,059
19 Oct 202654,080
26 Oct 2026242,195
2 Nov 202689,617

Weekly downloads over the last 4 weeks are 39% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - JotformScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Contact Form Clean and SimpleScore 91 · 7,000+Formzu WPScore 91 · 3,000+Woorise - Forms, Quizzes & GiveawaysScore 91 · 1,000+

Facts

Version1.58.4
AuthorWPMU DEV - Your All-in-One WordPress Platform
Added4 Sep 2018
Last updated2 Nov 2026
Active installs600,000+
Requires WordPress6.4
Tested up to7.1.4
Requires PHP7.4
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, custom form, contact form, payment form, WordPress form plugin

Other plugins by this author: Smush - Image Optimization, Compression, Lazy Load, WebP & CDN, Broken Link Checker, Hustle - Email Marketing, Lead Generation, Optins, Popups, Defender Security - Malware Scanner, Login Security & Firewall, Hummingbird Performance - Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN, Beehive Analytics - Google Analytics Dashboard, SmartCrawl SEO checker, analyzer & optimizer, Branda - White Label & Branding, Free Login Page Customizer

Questions

Is Forminator Forms - Contact Form, Payment Form & Custom Form Builder still maintained?

Forminator Forms - Contact Form, Payment Form & Custom Form Builder was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is Forminator Forms - Contact Form, Payment Form & Custom Form Builder safe?

Forminator Forms - Contact Form, Payment Form & Custom Form Builder has no open unpatched vulnerabilities on record. 52 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns Forminator Forms - Contact Form, Payment Form & Custom Form Builder?

The wordpress.org author is WPMU DEV - Your All-in-One WordPress Platform. Recent committers: ivansvyrskyi, panoslyrakis, Dency, vanyukov, alerzhus. We have recorded no ownership change.

What can I use instead of Forminator Forms - Contact Form, Payment Form & Custom Form Builder?

Plugins in the same category with a higher Canary Score: Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - Jotform, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Contact Form Clean and Simple, Formzu WP, Woorise - Forms, Quizzes & Giveaways.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue