cformsII

cformsII has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2010 and 2026; all 13 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 4 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (46%). Other recurring categories include Cross-Site Request Forgery (CSRF), SQL Injection.

Every one of the 13 issues recorded for cformsII has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (2) reported by emad. cformsII is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
6.7/ 10
Patch Coverage100%
Open

0

Fixed

13

Get automatic notifications for all cformsII vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2015-9333

cformsII < 14.6.10 - SQL Injection

Read the full analysis

Vulnerability Records

13 records
Plugin Profile
Latestv15.1.4
4.3(21)
86/100
Last Updated
2026-04-11 (5mo ago)
Active Installs
3,000+
Downloads
261,270
Requires WP
6.9+
Requires PHP
0+
Tested up to
WP 6.9.7
Created
2014-10-15 (12y ago)

This is a fork of cformsII, a highly customizable, flexible and powerful form builder plugin, covering a variety of use cases and features. If you want to use plugin versions older than 14.6.3, you should rename the directory containing the plugin from “cforms2” to “cforms”. But bear in mind that old versions should not be used in public systems, because they contain known serious vulnerabilities that are exploited in the wild. The current security baseline version is 15.1.4. Related Plugins Really Simple CAPTCHA for cformsII provides an image CAPTCHA via cformsII’s pluggable CAPTCHA facility. To convert the old CAPTCHA fields to Really Simple CAPTCHA, please install the current version and activate the plugin. Contact Form DB has support for storing and exporting cformsII’s submission data. Be sure to enable CFDB’s capture submission support for cformsII. Old Tracking DB for cformsII is for those who do not want to switch from the built-in Tracking DB to CFDB. However it does not have any web interface. ReCaptcha Integration for WordPress provides a reCAPTCHA implementation for cformsII. Localization You can see the available languages and contribute via GlotPress. Only some of them that are almost completely translated are installed automatically. If you want to install another language, please choose its cell in the Development column, export it as Machine Object Message Catalog (.mo) and put it in the wp-content/languages/plugins directory.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C