FormFacade – Embed Google Forms in your website
FormFacade – Embed Google Forms in your website has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2025; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.8, and the most serious one scores 6.4 out of 10. 2024 was the busiest year with 4 disclosures.
The most common weakness is Cross-Site Scripting, behind 4 of the records (80%). Other recurring categories include Cross-Site Request Forgery (CSRF).
4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
5 independent researchers contributed these findings, one record each. FormFacade – Embed Google Forms in your website is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-62133FormFacade <= 1.4.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

FormFacade – Embed Google Forms in your website
Author
manidoraisamy
You love Google Forms™, but not its UI? You are at the right place! You are a startup founder or a project owner, who likes to move fast. So, you quickly put together a Google form™ to connect with your users. But, what do your users think when they see a form that doesn’t have your branding? Does it give them the confidence that you will be able to deliver a great product or service, when you can’t even show them a professional looking form? Formfacade modifies Google Forms™ to blend with your websites and apps. Replace Google branding in the forms with your own branding and gain your users’ trust. Try it out Step 1: Login to your WordPress site as an admin Step 2: Install and Activate the Formfacade WordPress plugin for Google Forms™ Step 3: Follow the prompts in the setup wizard to embed the Google Forms™ For detailed instructions, refer to this help article. https://formfacade.com/embed/embed-google-forms-in-wordpress.html Features Make your embedded form look like your website Convert your Google Forms™ into a tailor-made form that fits neatly in your website. Once the user submits the form, you can manage them with Google Sheet™ or Google Forms™, you are comfortable with. Gain your users’ trust with a professional user experience, while still being scrappy. Prefill your embedded form Google Forms™ prefill feature does not work with embedded form. With Formfacade, you can append the prefill url from Google Forms™ to the url of the webpage that embeds the Formfacade form. Formfacade will automatically read your webpage url and prefill the form appropriately. Analyze where users are dropping off using session recording tools Google Forms™ embedded in your website can’t be analyzed using session recording tools. This is critical for forms with multiple sections. Formfacade allows you to analyze user behaviour and see where they are dropping off using session recording tools like FullStory or Hotjar. Customize UI With customize UI paid plans, you can also customize the form layout, apply custom styles, change form field permissions (editable, hidden, readonly), update the placeholder text, format the question, description, add dynamic response validations, add calculations, enter a caption to update the button text, personalize the confirmation message and redirect users to another webpage on submit. Pricing Free plan for 20 responses per month. Paid plan starts at $18 for 100 responses per month. Ask support@formfacade.com for questions. External service used in this plugin This plugin uses our external web service (Formfacade). This external service provides two functionality: Covert the Google Forms™ into a WordPress specific form that renders natively. Submit the form details using AJAX without redirecting the user to a Google Forms™ page. FormFacade collects personal and non-personally identifiable information solely for the purpose of providing our services to you (i.e. to submit the form). You can read our privacy policy here: https://formfacade.com/privacy.html
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C