Skip to content
PluginCanary

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More

by Syed Balkhi · 5,000,000+ active installs · Checked 3 Nov 2026
Healthy5 Warnings

Healthy: vulnerability published 14 Oct 2026, fixed in 2.0.2.2.

81/ 100 Canary Score
Sub-scores for WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More
Ownership100
Maintenance100
Security60
Support71
Reputation70

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 14 Oct 2026, fixed in 2.0.2.2. Update to version 2.0.2.2 or later.14 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 9 Oct 2026, fixed in 2.0.2.2. Update to version 2.0.2.2 or later.9 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 2.0.2.1. Update to version 2.0.2.1 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 24 Sep 2026, fixed in 2.0.2.1. Update to version 2.0.2.1 or later.24 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 22 Sep 2026, fixed in 2.0.2. Update to version 2.0.2 or later.22 Sep 2026Evidence
  • InfoSEC-319 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
jaredatch14 Mar 2016 to 5 Mar 2020, 225 commits
slaFFik19 Mar 2020 to 13 Dec 2023, 66 commits
dimitris.m28 Nov 2023 to 29 Oct 2026, 75 commits
jrfoell16 Jan 2024 to 28 Oct 2024, 10 commits

4 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
6 days ago
Releases, 24 months
43
Tested up to
7.1 current
Requires PHP
7.2 supported 8.2+
Releases per quarter for WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More
Q1 20245
Q2 20245
Q3 20248
Q4 20247
Q1 20254
Q2 20255
Q3 20255
Q4 20253
Q1 20265
Q2 20267
Q3 20268
Q4 20263

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Support

71% of 21 support threads resolved in the last 2 months.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
14 Oct 2026WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass on Paid Forms5.31.10.0.1 to 2.0.2.12.0.2.20
9 Oct 2026WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute4.7<= 2.0.2.12.0.2.20
24 Sep 2026WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter6.1<= 2.0.22.0.2.10
24 Sep 2026WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution6.51.5.0.1 to 2.0.22.0.2.10
22 Sep 2026WPForms Lite 1.8.8.2 - 2.0.1.1 - Missing Authorization5.31.8.8.2 to 2.0.1.12.0.20
20 Jul 2026WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content4.9<= 2.0.0.12.0.0.20
30 Jun 2026WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name5.3<= 1.10.21.10.2.10
5 Jun 2026WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint5.3<= 1.10.0.41.10.0.50
28 May 2026WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization5.3<= 1.10.0.41.10.0.50
19 May 2026WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass5.3<= 1.10.0.41.10.0.50
31 Mar 2026Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery4.3<= 1.10.0.21.10.0.38
23 Mar 2026WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure5.3<= 1.9.8.71.9.9.20
7 Mar 2026Contact Form by WPForms <= 1.9.9.3 - Missing Authorization4.3<= 1.9.9.31.9.9.40
9 May 2025WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter5.4<= 1.9.51.9.5.10
3 Feb 2025WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter6.4<= 1.9.3.11.9.3.20
3 Jan 2025Contact Form by WPForms <= 1.9.2.2 - Missing Authorization4.3<= 1.9.2.21.9.2.30
9 Dec 2024WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation8.51.8.4 to 1.9.2.11.9.2.20
5 Dec 2024WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting4.4<= 1.9.2.21.9.2.30
12 Nov 2024WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion4.3<= 1.9.1.61.9.2.10
4 Nov 2024WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 1.9.1.51.9.1.60
1 May 2024Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation5.3<= 1.8.7.21.8.8.20
20 Jun 2023Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting6.1<= 1.8.1.21.8.1.30
19 Sep 2022Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal6.8<= 1.7.5.31.7.5.50
21 May 2020Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting7.2< 1.6.0.21.6.0.20
18 Feb 2020Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting6.4< 1.5.91.5.9n/a

Source: Wordfence Intelligence.

Reputation

Average rating rose from 4.1 to 4.4 between Q3 2026 and Q4 2026.

Rating distribution
5 star13528
4 star314
3 star102
2 star77
1 star366
Latest low reviews

Momentum

5,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More
4 May 2026144,686
11 May 20262,245,322
18 May 2026659,381
25 May 20262,326,261
1 Jun 20262,366,605
8 Jun 2026373,397
15 Jun 20262,127,044
22 Jun 20262,234,883
29 Jun 2026469,874
6 Jul 2026522,979
13 Jul 20263,476,243
20 Jul 2026430,216
27 Jul 2026276,799
3 Aug 2026227,947
10 Aug 20264,110,916
17 Aug 20262,473,200
24 Aug 20262,239,814
31 Aug 2026548,337
7 Sep 2026263,720
14 Sep 20262,477,933
21 Sep 20262,620,615
28 Sep 2026342,076
5 Oct 20262,548,691
12 Oct 2026293,258
19 Oct 20262,223,962
26 Oct 20262,564,988
2 Nov 202686,461

Weekly downloads over the last 4 weeks are 14% below the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - JotformScore 91 · 20,000+Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & MoreScore 91 · 10,000+Contact Form Clean and SimpleScore 91 · 7,000+Formzu WPScore 91 · 3,000+Woorise - Forms, Quizzes & GiveawaysScore 91 · 1,000+

Facts

Version2.0.3.1
AuthorSyed Balkhi
Added14 Mar 2016
Last updated29 Oct 2026
Active installs5,000,000+
Requires WordPress5.5
Tested up to7.1.4
Requires PHP7.2
CategoryForms & Data Collection > Form Builders & Creators
Tagsforms, custom form, contact form, form builder, contact form plugin

Other plugins by this author: WP Mail SMTP by WPForms - SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More, WPCode - Insert Headers and Footers + Custom Code Snippets - WordPress Code Manager, All in One SEO - AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights), Popup Builder & Popup Maker for WordPress - OptinMonster Email Marketing and Lead Generation, Smash Balloon Social Photo Feed - Easy Social Feeds Plugin, One Click Demo Import, Duplicator - Backups & Migration Plugin - Cloud Backups, Scheduled Backups, & More, Easy WP SMTP - WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more, Photo Gallery, Sliders, Proofing and Themes - NextGEN Gallery, WP Crontrol, PDF Embedder - PDF Viewer & Embed PDF Files for WordPress, WP Mail Logging

Questions

Is WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More still maintained?

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More was last updated on 29 Oct 2026. Its Canary status is Healthy.

Is WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More safe?

WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More has no open unpatched vulnerabilities on record. 20 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More?

The wordpress.org author is Syed Balkhi. Recent committers: dimitris.m, jrfoell, slaFFik, jaredatch, smub. We have recorded no ownership change.

What can I use instead of WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More?

Plugins in the same category with a higher Canary Score: Online Forms - Customizable Payment, Contact, Quiz, Survey Form Builder - Jotform, Zoho Forms - Drag & Drop Form Builder for Websites - Contact Forms, Payment Forms, Order Forms & More, Contact Form Clean and Simple, Formzu WP, Woorise - Forms, Quizzes & Giveaways.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue