Contact Form Builder by vcita
Contact Form Builder by vcita has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Cross-Site Request Forgery (CSRF).
Every one of the 5 issues recorded for Contact Form Builder by vcita has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, most of them (3) reported by Jonas Höbenreich. Contact Form Builder by vcita is installed on roughly 700 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2025-32199Contact Form Builder by vcita <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records

Contact Form Builder by vcita
Author
eyale-vc
vcita’s Contact Form is the ultimate way to capture and manage leads on your WordPress website. Create and integrate beautiful forms in seconds – customized to any purpose and perfectly match the website theme and design. Contact Form Builder key features: Easily create and embed responsive contact forms that look great on any device Full customisation of the contact form look and feel – layout, colors, size, fonts and more Easy to add, remove, edit and reorder contact form fields Create as many forms as you want and embed those on any website Select which fields are mandatory on you contact form Unlimited number of fields on your contact form Add any question you need to your contact form. vcita will show all the information your clients provided on a client card including their picture, age and more Multiple contact form field options to choose from: Text fields, numeric fields, text areas and dropdown fields on your contact form Language customisation for all contact form texts and labels Unlimited contact form entries Receive Email & SMS notifications on any contact form submission, and provide immediate follow-up using any device. Manage all leads using vcita’s CRM tool. Export all contact form submissions and client information to Excel or CSV Send clients email confirmation for any contact form submission Easily search for contacts and follow up: take notes, edit contact information and track sent emails Learn more about our Contact Form for WordPress
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C