Formality
Formality has 3 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 3 are fixed as of September 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 0 high. 2025 was the busiest year with 3 disclosures.
The most common weakness is Cross-Site Scripting, behind 1 of the records (33%). Other recurring categories include Path Traversal, PHP Remote File Inclusion.
Every one of the 3 issues recorded for Formality has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Formality is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.
CVE-2025-48157Formality <= 1.5.9 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records

Formality
Author
Michele Giorgi
Formality is an all-in-one WordPress form plugin that puts design and user experience first. Each form is characterized by an essential interface and a modern layout that follows the most recent UX patterns. No frills, no superfluous or overly characterized elements. No matter what theme you are using… with a few simple options you can quickly customize your forms and align them to your website design. Why choose Formality Formality is not the best nor the most complete form plugin. Formality does few things but it does them well and it continues to improve every day. Designless – Smart layout with simple UI and common UX patterns Conversational – Distraction-free form experience Multistep – Group your questions in multistep form Simple editor – Gutenberg-based form builder Smooth – Async data submit with WP REST API Security – Prevent spam with built-in token authentication Logic condition – Show/hide fields based on user answers Collect data – Simple interface to manage all your form results Explore our brand new website for some awesome form examples that you can create with Formality. Documentation/support We are working on the full documentation which will be available soon… In the meantime, you can request support or report a bug on the Support page, or write us an email for any information. Dev Hooks You can extend Formality plugin functionality with its custom hooks. Formality has Filters, Actions and DOM Events for developers. You can find a wip reference page to start with, on this Gist. Translations Formality is now available in 5 languages. You can now choose between English, Italian, Indonesian, Czech and Swedish (Thanks to WordPress Community). You can help translating Formality to your language on translate.wordpress.org
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C