WP-FormAssembly

WP-FormAssembly has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.5 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Server-Side Request Forgery (SSRF).

Every one of the 5 issues recorded for WP-FormAssembly has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. WP-FormAssembly is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP-FormAssembly vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.5CVE-2022-45852

WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read

Read the full analysis

Vulnerability Records

5 records


2025-02-17 15:41	WP-FormAssembly <= 2.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode WP-FormAssembly <= 2.0.11	`CVE-2024-13501`	6.4 Medium	Muhammad Yudha - DJ	Yes
2024-04-16 00:00	WP-FormAssembly <= 2.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting WP-FormAssembly <= 2.0.10	`CVE-2023-49768`	6.4 Medium	Khalid	Yes
2023-05-02 00:00	WP-FormAssembly <= 2.0.8 - Limited Server Side Request Forgery via 'formassembly' shortcode WP-FormAssembly < 2.0.9	`N/A`	5.0 Medium	Anonymous	Yes
2023-04-18 00:00	WP-FormAssembly <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode WP-FormAssembly <= 2.0.7	`N/A`	6.4 Medium	Anonymous	Yes
2022-11-23 00:00	WP-FormAssembly <= 2.0.5 - Authenticated (Contributor+) Arbitrary File Read WP-FormAssembly <= 2.0.5	`CVE-2022-45852`	6.5 Medium	Tien Nguyen Ahn	Yes

Showing 1–5 of 5 reports

Latestv3.0.3

WP-FormAssembly

Author

FormAssembly

4.0(3)

80/100

Last Updated

2026-05-19 (4mo ago)

Active Installs

2,000+

Downloads

95,335

Requires WP

4.0.0+

Requires PHP

Tested up to

WP 7.0.4

Created

2015-03-25 (12y ago)

Quickly embed FormAssembly web forms into your website with the FormAssembly WordPress Plugin! Use FormAssembly’s all-in-one form builder and data collection platform to: Create contact forms, applications, payment forms, and surveys. Integrate data with Salesforce, PayPal, Google Apps and more. Keep data secure with GDPR/CCPA compliance, PCI DSS Level 1 Certification, and encryption at rest. Sign up for a free trial at FormAssembly.com/sign-up to start building your form, then use the plugin and shortcode to embed forms onto your WordPress site.

View on WordPress.org