Formality

Formality has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 3 are fixed as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 0 high. 2025 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Path Traversal, PHP Remote File Inclusion.

Every one of the 3 issues recorded for Formality has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. Formality is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh
8.7/ 10
Patch Coverage100%
Open

0

Fixed

3

Get automatic notifications for all Formality vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2025-48157

Formality <= 1.5.9 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

3 records
Formality banner
Latestv1.5.11
5.0(10)
100/100
Last Updated
2025-07-01 (1y ago)
Active Installs
100+
Downloads
10,961
Requires WP
6.7+
Requires PHP
7.4+
Tested up to
WP 6.8.8
Created
2020-08-28 (6y ago)

Formality is an all-in-one WordPress form plugin that puts design and user experience first. Each form is characterized by an essential interface and a modern layout that follows the most recent UX patterns. No frills, no superfluous or overly characterized elements. No matter what theme you are using… with a few simple options you can quickly customize your forms and align them to your website design. Why choose Formality Formality is not the best nor the most complete form plugin. Formality does few things but it does them well and it continues to improve every day. Designless – Smart layout with simple UI and common UX patterns Conversational – Distraction-free form experience Multistep – Group your questions in multistep form Simple editor – Gutenberg-based form builder Smooth – Async data submit with WP REST API Security – Prevent spam with built-in token authentication Logic condition – Show/hide fields based on user answers Collect data – Simple interface to manage all your form results Explore our brand new website for some awesome form examples that you can create with Formality. Documentation/support We are working on the full documentation which will be available soon… In the meantime, you can request support or report a bug on the Support page, or write us an email for any information. Dev Hooks You can extend Formality plugin functionality with its custom hooks. Formality has Filters, Actions and DOM Events for developers. You can find a wip reference page to start with, on this Gist. Translations Formality is now available in 5 languages. You can now choose between English, Italian, Indonesian, Czech and Swedish (Thanks to WordPress Community). You can help translating Formality to your language on translate.wordpress.org

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C