Custom Contact Forms

Explore Custom Contact Forms vulnerabilities across all versions. Currently tracking 2 known vulnerabilities, including severity, impact, and patch status.

Strategic Overview

Avg CVSSHigh
8.0/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Custom Contact Forms vulnerabilities before they are exploited.

Vulnerability Records

2 records
Custom Contact Forms banner
Latestv7.14.0

Custom Contact Forms

outlawgt

Author

outlawgt

3.5(171)
70/100
Last Updated
2026-07-25 (4d ago)
Active Installs
6,000+
Downloads
1,313,396
Requires WP
5.0+
Requires PHP
7.4+
Tested up to
WP 7.0.2
Created
2010-07-22 (16y ago)

Custom Contact Forms lets you build forms and manage submissions entirely within WordPress. The drag-and-drop builder lives inside the media manager — no separate admin pages, no learning a new interface. Live previews update as you build, and forms can be inserted via Gutenberg block, shortcode, widget, or PHP function. Start from a prebuilt template — contact, quote request, newsletter, event registration, or feedback — and have a working form in seconds. Or build your own from scratch with text, email, phone, address, dropdowns, checkboxes, file uploads, and more. Style it with included form themes and per-field width controls, or add your own custom CSS. Powering thousands of active websites, with over 1.3 million all-time downloads. Originally created by Taylor Lovett, Custom Contact Forms is now actively maintained by Dmitry Alexander — rebuilt for modern WordPress with a hardened, PHP 8+ codebase, a refreshed builder, and new features added regularly. What You Can Build Contact forms, quote requests, support forms, event registrations, newsletter signups Text, paragraph, email (with optional confirmation), name, phone, website, address (US + international), date/time, dropdowns, checkboxes, radio buttons, file uploads, hidden fields, and HTML blocks Conditional fields and sections — show/hide fields based on other field values Multiple email notifications per form — customize recipients, subject, from name, reply-to, and body with field mapping Post creation on submission — map form fields to post fields, meta, and taxonomies Recent Updates Modernized builder — Yes/No options are now clean toggle switches, and fields display as cards in the builder canvas Friendly submission columns — The submissions table now shows real field labels instead of internal slugs Redesigned templates screen — Each form template now has its own custom icon, under Forms → Templates Developer hooks for add-ons — Filter submission responses, field rendering, and notification timing WordPress 7.0 ready — Tested up to the latest WordPress Powerful Features, Included Free Drag-and-drop form builder with live preview in the media manager Prebuilt form templates for the most common form types Gutenberg block, shortcode, widget, and PHP template support Multiple form themes plus per-field width controls and custom CSS AJAX form submission — no page reloads Export submissions to CSV, and import submissions from CSV with automatic column mapping Import and export forms via WordPress XML Cloudflare Turnstile, reCAPTCHA, and simple captcha options Built-in spam protection — honeypot, time-based trap, IP rate limiting, disposable email blocking, keyword blacklist Email diagnostics — send test emails and view delivery failure logs Restrict forms to logged-in users, or pause forms with a custom message Customizable completion text or redirect URL Conditional asset loading — only load scripts where forms appear Extensible with hooks, filters, and custom field types Quick Start Go to Forms → Templates and pick a starting template — or go to Forms → Forms and Submissions to start from scratch Drag fields from the sidebar into the form area, and click a field to edit its label, width, and options Save the form Insert it with the Gutenberg block (search “CCF” in the block inserter) or the [ccf_form id="X"] shortcode Customize More with Pro Custom Contact Forms Pro turns the builder you already know into forms that sell, book, and sign — no e-commerce stack required. Stripe payments on the form — cards, Apple Pay, Google Pay, and Link, with a live “Pay $25.00” button and server-verified totals Product & pricing fields — fixed price, multiple options, or customer-chooses-amount, with quantities, images, and enforced minimums Coupons & live totals — percentage or fixed discounts, order total updates as visitors choose Digital signature field — draw with mouse, finger, or stylus; saved as an image with every submission Consent / terms field — scrollable terms with versioned agreement records, snapshotted permanently PDF receipts — attached to notification emails for paid orders, plus one-click PDF download of any submission Multi-step forms — page breaks, progress bar, per-step validation Conditional logic — show or hide any field based on answers, priced fields included Survey & star rating fields — Likert grids and quick ratings 13 ready-made templates — donations, orders, registrations, waivers, agreements, and more No added transaction fees — you pay only Stripe’s standard processing fees Learn more about Custom Contact Forms Pro External Services This plugin optionally connects to the following third-party services for spam protection. These services are only used when the site administrator explicitly enables and configures them. Google reCAPTCHA When enabled in the form builder, this plugin loads the Google reCAPTCHA widget on form pages and sends form submission verification requests to Google’s servers. The user’s reCAPTCHA response token is sent to Google for validation. No personal data is sent by the plugin itself — Google may collect usage data through their widget script. Service provider: Google LLC Terms of Service Privacy Policy Cloudflare Turnstile When enabled in Forms → Settings → Cloudflare Turnstile, this plugin loads the Cloudflare Turnstile widget script on form pages and sends form submission verification requests to Cloudflare’s servers. The user’s Turnstile response token and the visitor’s IP address are sent to Cloudflare for validation. Service provider: Cloudflare, Inc. Terms of Service Privacy Policy

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C