Contact Forms by Cimatti

Contact Forms by Cimatti has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2025; all 11 are fixed as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (45%). Other recurring categories include Cross-Site Request Forgery (CSRF), Missing Authorization.

Every one of the 11 issues recorded for Contact Forms by Cimatti has a vendor fix available, so running the current release closes all known holes.

10 independent researchers contributed these findings, most of them (2) reported by thiennv. Contact Forms by Cimatti is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.2/ 10
Patch Coverage100%
Open

0

Fixed

11

Get automatic notifications for all Contact Forms by Cimatti vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2024-29117

Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting

Read the full analysis

Vulnerability Records

11 records
2025-06-02 00:00CVE-2025-49069
4.3
Medium
Shivam KhannaYes
2025-01-31 00:00CVE-2024-12184
5.3
Medium
rcl25Yes
2024-11-26 22:58CVE-2024-10521
4.3
Medium
vgo0Yes
2024-03-29 00:00CVE-2024-30549
4.4
Medium
Joel IndraYes
2024-03-16 00:00CVE-2024-29117
7.2
High
Joshua ChanYes
2023-10-25 00:00CVE-2023-47230
4.3
Medium
Nguyen Xuan ChienYes
2023-06-13 00:00CVE-2023-35051
4.3
Medium
Abdi PranataYes
2023-06-12 00:00CVE-2023-2563
4.3
Medium
Marco WotschkaYes
2023-03-27 00:00CVE-2023-28781
7.2
High
thiennvYes
2023-03-27 00:00CVE-2023-28789
6.1
Medium
thiennvYes
Showing 1–10 of 11 reports
Contact Forms by Cimatti banner
Latestv2.3.6

Contact Forms by Cimatti

cimatti

Author

cimatti

4.4(16)
88/100
Last Updated
2026-09-02 (10d ago)
Active Installs
600+
Downloads
84,647
Requires WP
5.9+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2013-07-25 (13y ago)

Live Preview – Try it in WordPress Playground (form submission is not available in the live preview) Forms are an essential component of any website. Contact Forms by Cimatti is the culmination of years of experience building and developing business websites of all types. Our plugin focuses on simplicity, power, and accessibility, helping you capture, store, and classify contacts according to their lead status. It’s ideal for single-language and multilingual sites, simple blogs, or complex WordPress-powered Content Management Systems. Accessibility First Contact Forms is built with accessibility at its core, designed to meet WCAG 2.2 AA standards and comply with the European Accessibility Act: Screen Reader Support: All form elements are properly labelled and wired with aria-describedby and aria-invalid, with live regions for dynamic updates and meaningful error announcements Keyboard Navigation: Full keyboard accessibility for all interactions, including drag-and-drop file uploads Clear Error Messages: Validation summary with clickable links to problematic fields, smooth scroll and focus management Accessible Loading States: Visual and screen reader feedback during form submission Reduced Motion Support: Respects prefers-reduced-motion user preference High Contrast: Error and success states designed for visibility Select, Configure, and Embed Forms Choose the fields you require, customize on-screen messages and email responses, preview, and effortlessly embed forms into your posts, pages, or custom content types using the Contact Form block, a shortcode, or the button in the classic visual editor. Create Forms for Any Purpose Create as many forms as you need. Design landing pages, contact pages, invitations, job application forms with curriculum upload, customer request forms, spare part requests, and more. Utilize the “Clone” feature to avoid “reinventing the wheel” when creating new forms. Ready-to-Use Features Contact Forms by Cimatti has commonly used fields like First Name, Last Name, Address, Province, Country, Telephone, Email, Captcha, and default success messages and email notifications. Simply create a drag-and-drop form, save it, go to a post or page, and insert it with the Contact Form block or, in the classic visual editor, with the Contact Forms button in the toolbar. Easy to Use for Beginners These features make it effortless for first-time users, but the plugin’s fast learning curve will soon entice you to explore its advanced features. Craft Superior Forms Don’t leave anything to chance; fine-tune the entire form submission process. Spam Protection Stop spam with Google reCAPTCHA v2 (checkbox), the invisible score-based Google reCAPTCHA v3, Cap (the open-source proof-of-work captcha you host yourself), or Cloudflare Turnstile (which needs the free Simple Cloudflare Turnstile plugin). Captcha fields are added per form with drag and drop, so you protect only the forms that need it. With reCAPTCHA v2 and v3 you can also choose, per form, what happens when the check fails: accept the submission silently (the sender sees the normal success message while it is stored with the Spam status and no notification emails are sent), move it to Trash, delete it immediately, or reject it with a visible error so the visitor can retry. Each type ships with the default that fits it: silent for the invisible v3, a visible error for the v2 checkbox, so a real person who forgot to tick it is asked again instead of being filed as spam. For your visitors’ privacy, no request is made to Google until they start filling in the form – and with Cap running on your own server, no captcha request leaves your infrastructure at all. Create Reusable Fields Build custom fields to reuse multiple times, starting with 24 available field types, including Text Field, Text Area, Email, Autoreply Email, Telephone, Date, Checkbox, Multiple checkboxes, Radio buttons, Select, Multiple selections area, Post select, Color picker, Hidden value, File upload, Captcha, Custom HTML, Password, and more. Customize Forms to Perfection Apply visual styles to your forms using options in the “Appearance and General” tab. Select colors, margins, button styles, and more. Custom Messages for Success Each form can have its own unique online success message. So, when a form is completed, you can provide access to a file download link, coupon information, or simply a message to confirm that the form was submitted correctly. Email Notifications for Administrators and Visitors Send email notifications to administrators, including tracking information like visitor IP, referrer, date and time of form submission, and other user properties (for a full list, see the Beginners’ Guide). Send an email notification to the visitor as further confirmation that the form was filled in correctly. The live preview in the form editor lets you check the form before you publish it. Data Collection and Excel Export All submitted data is securely stored in your WordPress database. Contacts received can be easily categorized into lead status categories and spam and tests can be easily discarded. Add notes on each contact received to keep track. All contact data received can be filtered, searched, and exported to Excel at any time: export all the columns, or only the ones currently visible in the list. Exports open with the header row frozen and the column filters already switched on. Contact Forms also includes a tracking graph in its Dashboard that displays the performance of all or each of your website forms over time. Developer-Friendly API Contact Forms by Cimatti includes an API to assist developers in customizing and adding their own features. WordPress Filters are used to customize forms during generation, to check and validate submitted form values, to execute custom code using sent data, and to add custom tokens for messages. Read the documentation on our site for more information. Powerful PHP Form Builder Class Contact Forms by Cimatti utilizes a PHP form builder class to generate the forms, ensuring robust and efficient form creation and management.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C