Custom Contact Forms
Custom Contact Forms has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2012 and 2026; all 3 are fixed as of October 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Missing Authorization, behind 2 of the records (67%). Other recurring categories include Cross-Site Scripting.
Every one of the 3 issues recorded for Custom Contact Forms has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Custom Contact Forms is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
Custom Contact Forms <= 5.1.0.3 - Missing Authorization
Read the full analysisVulnerability Records

Custom Contact Forms
Author
outlawgt
Build powerful custom forms with an intuitive drag-and-drop builder. Create everything from simple contact forms to advanced forms with templates, Gutenberg, modern spam protection, and more. Custom Contact Forms gives you features many form plugins keep for their paid versions: every entry saved to your database, conditional logic, file uploads, a signature field, Mailchimp signup forms, webhooks to Zapier, Make and n8n, and a dashboard that shows how each form performs. Build with drag and drop, start from a template, or describe the form you need. Try it before you install: click Preview above to open a demo site with sample forms and a month of entries. Every Entry, Saved and Measured Each submission is stored in your WordPress database, so nothing is lost if a notification email goes astray. The Forms dashboard shows entries, form views, conversion rate and blocked spam for any date range, with a chart and a per-form breakdown. A weekly summary email brings the same numbers to your inbox every Monday. Export entries to CSV at any time. Mailchimp, Webhooks and More, on One Page Add people who fill in a form to a Mailchimp audience, with double opt-in and an optional consent checkbox. Each form chooses its own audience. Webhooks send every new entry to Zapier, Make, n8n or any other service that accepts them, so your forms can reach the apps you already use. Everything connects from one Integrations page: Mailchimp, webhooks, Akismet, hCaptcha, Cloudflare Turnstile and reCAPTCHA, each on its own card that shows whether it is connected. If a subscriber or webhook does not go through, the reason is listed under Recent problems, so you are not left guessing. Signatures, Free Add a signature field to any form. Visitors sign with a mouse, finger or stylus, and the signature is saved with the entry and included in the notification email. Smart Forms Without Code Conditional logic is included free: show or hide fields and sections based on answers. Accept file uploads, lay fields out in columns, send multiple email notifications per form, and create a WordPress post from a submission. Switch From Contact Form 7 in One Step Contact Form 7 does not save submissions. Import your Contact Form 7 and WPForms forms with their labels, fields and notification email under Forms → Import. Your original forms are only read, never changed. AI That Stays On Your Site Describe the form you need, such as “a booking form for a dog grooming appointment with the owner’s details and their preferred date”, and it is built for you, ready to edit. It uses the AI provider already connected to your site under Settings > Connectors, so there is no API key to enter and nothing is sent to us. Requires WordPress 7.0 or later; the option stays hidden otherwise. Spam Protection Built In Cloudflare Turnstile, hCaptcha, reCAPTCHA, honeypot, time trap, rate limiting, disposable email blocking and a keyword blacklist, with every blocked attempt counted on the dashboard. If you use Akismet, entries it flags go to a spam folder instead of being thrown away, so a real message caught by mistake is never lost. Build Your Way The drag-and-drop builder lives inside the media manager, so there are no separate admin pages and no new interface to learn. Live previews update as you build. Start from a prebuilt template (contact, quote request, newsletter, event registration, or feedback), style forms with included themes, per-field widths or your own CSS, and insert them with the Gutenberg block, shortcode, widget, or PHP function. Powering thousands of active websites, with over 1.3 million all-time downloads. Originally created by Taylor Lovett, Custom Contact Forms is now actively maintained by Dmitry Alexander, rebuilt for modern WordPress with a hardened, PHP 8+ codebase, a refreshed builder, and new features added regularly. What You Can Build Contact forms, quote requests, support forms, event registrations, newsletter signups, service agreements Mailchimp newsletter signup forms with double opt-in and a consent checkbox Signed agreements, release forms and waivers with a signature field Forms that send every entry to Zapier, Make, n8n or your own app with webhooks Text, paragraph, email (with optional confirmation), name, phone, website, address (US + international), date/time, dropdowns, checkboxes, radio buttons, file uploads, signatures, hidden fields, and HTML blocks Conditional fields and sections: show/hide fields based on other field values Multiple email notifications per form: customize recipients, subject, from name, reply-to, and body with field mapping Post creation on submission: map form fields to post fields, meta, and taxonomies Powerful Features, Included Free Forms dashboard with entries, views, conversion rate and blocked spam for any date range Weekly summary email with entries and views per form (easy to turn off) Mailchimp: add subscribers to a different audience per form, with double opt-in Webhooks: send each new entry as JSON to Zapier, Make, n8n or any URL Signature field that works on phones, tablets and desktops Drag-and-drop form builder with live preview in the media manager Prebuilt form templates for the most common form types Build a form by describing it, using your site’s own AI connection Gutenberg block, shortcode, widget, and PHP template support Multiple form themes plus per-field width controls and custom CSS AJAX form submission: no page reloads Import your forms from Contact Form 7 and WPForms: fields, labels, required flags, placeholders, and choices, with a report of anything that needs your attention Export submissions to CSV, and import submissions from CSV with automatic column mapping Import and export forms via WordPress XML Cloudflare Turnstile, hCaptcha, reCAPTCHA, and simple captcha options Akismet checks with a spam folder: move a flagged entry back with one click Integrations page: every integration on one screen, with what is free, what needs Pro, and what is connected Built-in spam protection: honeypot, time-based trap, IP rate limiting, disposable email blocking, keyword blacklist Email diagnostics: send test emails and view delivery failure logs Submissions widget on your WordPress dashboard Restrict forms to logged-in users, or pause forms with a custom message Customizable completion text or redirect URL Conditional asset loading: only load scripts where forms appear Extensible with hooks, filters, and custom field types Quick Start Go to Forms → Templates and pick a starting template, or go to Forms → Forms and Submissions to start from scratch Drag fields from the sidebar into the form area, and click a field to edit its label, width, and options Save the form Insert it with the Gutenberg block (search “CCF” in the block inserter) or the [ccf_form id="X"] shortcode Click Forms in the admin menu to see entries, views and conversion rates on the Forms dashboard Customize More with Pro Custom Contact Forms Pro turns the builder you already know into forms that sell, book, and sign, with no e-commerce stack required: Stripe and PayPal payment forms, donation forms, deposit and booking forms, and waivers with signed PDF records. Stripe payments on the form: cards, Apple Pay, Google Pay, and Link, with a live “Pay $25.00” button and server-verified totals PayPal payments: pay in place without leaving your form, with the same server-verified totals Product & pricing fields: fixed price, multiple options, or customer-chooses-amount, with quantities, images, and enforced minimums Coupons & live totals: percentage or fixed discounts, order total updates as visitors choose Signatures in PDF receipts: the signature appears in the PDF receipt, alongside consent records and waiver and agreement templates Consent / terms field: scrollable terms with versioned agreement records, snapshotted permanently PDF receipts: attached to notification emails for paid orders, plus one-click PDF download of any submission Multi-step forms: page breaks, progress bar, per-step validation Conditional pricing: show or hide products and priced fields based on answers More email marketing: MailerLite, Brevo, Kit, ActiveCampaign and MailPoet, alongside the free Mailchimp connection Survey & star rating fields: Likert grids and quick ratings Address autocomplete: visitors pick their address as they type and the street, city, state and ZIP fill themselves in (uses your own Google API key) SMS confirmations: text customers the moment they book or pay, through your own Twilio account 13 ready-made templates: donations, orders, registrations, waivers, agreements, and more No added transaction fees: you pay only Stripe’s or PayPal’s standard processing fees Learn more about Custom Contact Forms Pro External Services This plugin optionally connects to the following third-party services for spam protection, email marketing and webhooks. These services are only used when the site administrator explicitly enables and configures them. Google reCAPTCHA When enabled in the form builder, this plugin loads the Google reCAPTCHA widget on form pages and sends form submission verification requests to Google’s servers. The user’s reCAPTCHA response token is sent to Google for validation. No personal data is sent by the plugin itself, though Google may collect usage data through their widget script. Service provider: Google LLC Terms of Service Privacy Policy Cloudflare Turnstile When enabled on the Cloudflare Turnstile card in Forms → Integrations, this plugin loads the Cloudflare Turnstile widget script on form pages and sends form submission verification requests to Cloudflare’s servers. The user’s Turnstile response token and the visitor’s IP address are sent to Cloudflare for validation. Service provider: Cloudflare, Inc. Terms of Service Privacy Policy hCaptcha When enabled on the hCaptcha card in Forms → Integrations, this plugin loads the hCaptcha widget script on form pages and sends form submission verification requests to hCaptcha’s servers. The visitor’s hCaptcha response token, the site key and the visitor’s IP address are sent to hCaptcha for validation. Service provider: Intuition Machines, Inc. Terms of Service Privacy Policy Akismet When the Akismet plugin is installed and set up, and Akismet checks are turned on in its card on Forms → Integrations, the name, email, website and text fields of each entry, the visitor’s IP address, browser user agent and referring page are sent to Akismet to check for spam. When you choose “Not spam”, the entry is sent to Akismet again so it can learn from the correction. Service provider: Automattic, Inc. Terms of Service Privacy Policy Mailchimp When you add a Mailchimp API key in Forms → Integrations and choose an audience for a form, this plugin connects to the Mailchimp Marketing API to list your audiences, and sends the email address and name from each entry of that form to the chosen audience. If you choose a consent checkbox, only entries where it is ticked are sent. Service provider: The Rocket Science Group LLC (Intuit Mailchimp) Terms of Use Privacy Statement Webhooks When you add webhook URLs to a form, each new entry of that form (the form name, entry date, page address and every field’s label and value) is sent to those URLs. Only the URLs you enter are contacted. The terms and privacy policy of the service you choose apply to the data it receives. Custom Contact Forms tips and news (oiopublisher.com) The plugin offers an optional signup for tips and release news, once on the Forms dashboard and once in the form builder, and on Forms > Settings. Only if you click Subscribe, the plugin sends the email address and first name you entered, your site address, your Custom Contact Forms and WordPress versions, where you signed up, and the consent wording shown to you, to our server at api.oiopublisher.com. Choosing “No thanks” or closing the box sends nothing. Every email we send has an unsubscribe link, and you can ask us to remove your details at any time. Service provider: OIO Publisher (the publisher of Custom Contact Forms) Privacy Policy Custom Contact Forms blog (customformspro.com) The Custom Contact Forms widget on the WordPress Dashboard and the Forms Dashboard page show the titles and dates of the three latest posts from our blog. To get them, your site’s server reads the public feed at https://customformspro.com/feed/ at most once every 12 hours and keeps a copy. Like every request WordPress makes, it carries your site’s address and WordPress version in its user agent. No form entries, user details or visitor data are sent, and nothing is loaded from our site in your visitors’ or users’ browsers. Hide the widget under Screen Options on the Dashboard, or developers can turn the blog posts off in both places with add_filter( 'ccf_dashboard_blog_feed', '__return_false' );. Service provider: OIO Publisher (the publisher of Custom Contact Forms) Privacy Policy
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C