Caldera Forms – More Than Contact Forms

Caldera Forms – More Than Contact Forms has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2016 and 2022; all 6 are fixed as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 6.5 out of 10. 2016 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (83%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 6 issues recorded for Caldera Forms – More Than Contact Forms has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Caldera Forms – More Than Contact Forms vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5

Caldera Forms – More Than Contact Forms < 1.4.0 - Sensitive Information Disclosure

Read the full analysis

Vulnerability Records

6 records


2022-03-28 00:00	Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api Caldera Forms < 1.9.7	`CVE-2022-0879`	6.1 Medium	Krzysztof Zając	Yes
2021-11-11 00:00	Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting Caldera Forms < 1.9.5	`CVE-2021-24896`	4.8 Medium	Dhananjay Garg	Yes
2018-04-20 00:00	Caldera Forms <= 1.5.9.1 - Cross Site Scripting Caldera Forms <= 1.5.9.1	`CVE-2018-7747`	5.5 Medium	Federico Scalco	Yes
2017-09-08 00:00	Caldera Forms <= 1.5.4 - Cross-Site Scripting Caldera Forms <= 1.5.4	`N/A`	5.4 Medium	Will Brand	Yes
2016-11-08 00:00	Caldera Forms <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting Caldera Forms <= 1.4.1	`N/A`	6.1 Medium	Jurgen Kloosterman	Yes
2016-05-24 00:00	Caldera Forms – More Than Contact Forms < 1.4.0 - Sensitive Information Disclosure Caldera Forms < 1.4.0	`N/A`	6.5 Medium	Panagiotis Vagenas	Yes

Showing 1–6 of 6 reports