Form Block
Form Block has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; all 2 are fixed as of September 2026. Their average CVSS score is 7.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type.
Every one of the 2 issues recorded for Form Block has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Form Block is installed on roughly 200 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-54693Form Block <= 1.5.5 - Unauthenticated Arbitrary File Upload
Read the full analysisVulnerability Records
Form Block
Author
epiphyt
WordPress offers several (contact) form plugins, but most of them are not up-to-date anymore when it comes to creating forms. Form Block tackles this problem by utilizing the block editor’s power. It enables you to create a form effortlessly within the block editor itself, which makes the process of creating a form much more enjoyable and similar to creating other types of blocks. This innovative approach to form creation ensures that Form Block stands out from other WordPress form plugins. Note: This plugins requires the PHP extension “Document Object Model” (php-dom). Features Fully support of the block editor Built with accessibility in mind Create forms with an unlimited number of fields Select from a wide variety of field types Use a predefined form or start from scratch Store form submissions in the WordPress backend Integrated honeypot for spam protection Integrated knowledge base for field types Client-side and server-side validation Getting started Add the “Form Block” block anywhere you want to enable a form in your block editor. Select a predefined form or start from scratch. Add/Edit/Remove fields to your form as you like. You can select from input, select and textarea fields. After submission, the form data will be sent to the email address you have set in the settings. Coming soon There is much more planned for Form Block. Here is a small selection of features that are coming soon: Antispam Bee integration Custom date picker More customization options Pro version There is also a Pro version of Form Block available. It offers additional features, such as: Extended server-side validation Custom recipient(s) for each form Custom form action Upload via drag and drop Field dependencies Multi-step forms with sections Advanced functionality for accessibility You can find more information at https://formblock.pro/en/. Contribution Feel free to contribute. The code is available at GitHub. Documentation You can find the documentation for Form Block at docs.epiph.yt.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C