FormCraft

FormCraft has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 6.0, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 2 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (75%). Other recurring categories include Missing Authorization.

Every one of the 4 issues recorded for FormCraft has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all FormCraft vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2026-7232

FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters

Read the full analysis

Vulnerability Records

4 records


2026-07-22 16:47	FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters FormCraft <= 3.9.14	`CVE-2026-7232`	7.2 High	Luc Huynh from Noventiq RedTeam	Yes
2025-02-17 00:00	FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload FormCraft <= 3.9.11	`CVE-2025-0817`	7.2 High	shaman0x01	Yes
2025-02-17 00:00	FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php FormCraft <= 3.9.11	`CVE-2024-13783`	4.3 Medium	Nguyễn Trung Kiên	Yes
2017-07-26 00:00	Premium WordPress Form Builder <= 3.2.31 - Authenticated Stored Cross-Site Scripting FormCraft < 3.4	`CVE-2017-18600`	5.4 Medium	8bitsec	Yes

Showing 1–4 of 4 reports