Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder

Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2025; 16 are fixed and 3 remain unpatched as of October 2026. Their average CVSS score is 5.5, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2023 was the busiest year with 12 disclosures.

The most common weakness is Missing Authorization, behind 11 of the records (58%). Other recurring categories include Cross-Site Scripting, Cross-Site Request Forgery (CSRF).

16 of the records (84%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2024.

9 independent researchers contributed these findings, most of them (8) reported by Alex Thomas. Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

01234567891014.12.2022Today18.07.20236.1Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVSS 6.1 · 18.07.202318.09.20236.5Funnelforms Free <= 3.3.9 - Unauthenticated Stored Cross-Site Scripting CVSS 6.5 · 18.09.202301.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Category Update CVSS 4.3 · 01.11.20236.5Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Deletion CVSS 6.5 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Post Modification CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Category Deletion CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark Mode CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post Duplication CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to Test Email Sending CVSS 4.3 · 01.11.20234.3Funnelforms Free <= 3.4 - Missing Authorization to New Category Creation CVSS 4.3 · 01.11.20236.5Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion CVSS 6.5 · 01.11.202327.08.20245.3Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload CVSS 5.3 · 27.08.20247.2Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload CVSS 7.2 · 27.08.20246.5Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion CVSS 6.5 · 27.08.202428.08.20245.3Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion CVSS 5.3 · 28.08.202403.12.20248.8Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection CVSS 8.8 · 03.12.202425.12.20255.3Funnelforms Free <= 3.8 - Missing Authorization CVSS 5.3 · 25.12.202531.12.20256.4Funnelforms Free <= 3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting CVSS 6.4 · 31.12.2025

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage84%
Open

3

Fixed

16

Get automatic notifications for all Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2024-10587

Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection

Read the full analysis

Vulnerability Records

19 records
2025-12-31 00:00CVE-2025-62758
6.4
Medium
Muhammad Yudha - DJNo
2025-12-25 00:00CVE-2025-68582
5.3
Medium
Legion HunterNo
2024-12-03 14:17CVE-2024-10587
8.8
High
Peter ThaleikisNo
2024-08-28 00:00CVE-2024-5857
5.3
Medium
Lucio SáYes
2024-08-27 00:00CVE-2024-7447
5.3
Medium
Lucio SáYes
2024-08-27 00:00CVE-2024-6311
7.2
High
István MártonYes
2024-08-27 00:00CVE-2024-6312
6.5
Medium
István MártonYes
2023-11-01 00:00CVE-2023-5417
4.3
Medium
Alex ThomasYes
2023-11-01 00:00CVE-2023-5386
6.5
Medium
Alex ThomasYes
2023-11-01 00:00CVE-2023-5411
4.3
Medium
Alex ThomasYes
Showing 1–10 of 19 reports
Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder banner
Latestv5.0.0

Funnelforms Free – Multi Step Form, Contact Form & Lead Funnel Builder

Funnelforms

Author

Funnelforms

4.8(32)
96/100
Last Updated
2026-10-23 (6d ago)
Active Installs
1,000+
Downloads
45,066
Requires WP
6.5+
Requires PHP
8.1+
Tested up to
WP 7.1.4
Created
2022-12-14 (4y ago)

Most contact forms lose visitors before they send anything: a long page of fields feels like work. Funnelforms turns the form into a conversation. Visitors answer one clear question at a time, mostly with a single tap, each answer leads to the question that fits it, and the contact details come last, when they have already invested in the answers. You get more leads, and you know what each lead needs before you call. Funnelforms Free is not just another form plugin. It builds conversion-optimized funnels that collect leads, inquiries and appointment requests, with no limits: as many forms, steps, fields and entries as you like, for as many visitors as you have. Use the drag and drop form builder for any form that should bring you customers: a multi step contact form, a quote or estimate request form, a lead generation form, a callback request, a job application form, a survey or feedback form, or a conversational form that asks one question at a time. No code needed, and it works with any theme. Why multi-step funnels convert An easy first step. The form opens with one simple question instead of a wall of fields, so visitors start with a click, not with a decision. A path for every answer. Each answer of a choice can lead to a step of its own, so every visitor only sees the questions that matter to them. Contact details at the end. The contact step comes when visitors have already told you what they need: salutation, name, e-mail, phone, text, list, checkbox, consent and captcha, only the fields you choose. Progress you can see. A progress bar and step count show visitors how close they are to the end. An end step that keeps the lead warm. Say thank you, offer downloads or a button, or send visitors on to any page. Twelve field types. Choice with icons or images (single and multiple), dropdown, short text, long text, e-mail, phone, web address, number, date, time, rating, text and media. Drag and drop canvas. Every step and every path of the form at a glance. Several fields per step, undo and redo, autosave. Templates for every goal Start from a funnel that already asks the right questions. Funnelforms Free comes with 37 templates, sorted by goal and industry, each with a thank-you page with the next steps and a mail to you with every detail of the lead. Every question and text can be changed. The gallery also shows the 61 templates of Funnelforms Pro, such as price calculators and quizzes, marked with a lock. Quotes: roofing, electrician, plumbing and heating emergency, gardening, alarm system, car purchase, video production and photography. Inquiries and consultations: contact form, kitchen studio, property sale, insurance check, private health insurance check, home care service, lawyer, tax advisor, funding check, business consulting, SaaS demo and marketing agency. Applications: jobs in trades, nursing and logistics, apprenticeships, employee referrals, franchise partners and tenant interest for a flat. Appointments and sign-ups: callback request, table reservation, property search, webinar and prize draw. Lead magnets and feedback: checklist download, NPS and satisfaction survey with a way to reviews, service and complaint requests, and win-back for cancellations. Setup assistant. Pick a goal and a template, add your colour and font, and your first form is live on a new page. Built for phones and fast pages One tap per answer. Answers as tiles with icons or images or as a list, set apart for desktop and phone, so they are easy to tap on any screen. Fast and light. The form loads one small script and works without jQuery, so your pages stay fast. Looks like your brand. Themes, colours and fonts, with a live preview on desktop, tablet and phone. Fonts are served from your own site, so visitors never contact a font service. Built for everyone: keyboard use, screen reader labels, visible focus and reduced motion are part of every form. Funnelforms block for the block editor, Elementor widget, shortcode, or a page of its own for each form. Measure and improve conversion Funnelforms Free shows how well each form turns visitors into leads and where visitors leave, so you know which question to change. Conversion at a glance. Views, entries and conversion rate of all forms, per day and per form, against the period before. From view to entry. How many visitors see a form, start it and send it. Drop-off per step. The steps most visitors leave on, in the statistics and right on the canvas, where each step shows how many visitors leave there. When and where. The weekday and hour entries come in, and the devices your visitors use. Your leads in WordPress All entries in WordPress, with search, filters and CSV export. A notification mail to you and a confirmation mail to the lead, with the answers, so you can reply quickly and the lead knows the request has arrived. Your own mail server. Send the mails through the SMTP server of your mail provider (Gmail, Microsoft 365, IONOS, STRATO, Brevo, SendGrid and more), with a test mail, so they arrive reliably and not in spam. If the server is down, they still go out through WordPress. Switch from another form plugin Funnelforms imports forms from Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Fluent Forms, Formidable Forms and Elementor forms, from the plugin on the same site or from its export file. Each form arrives as a draft you can check and publish; the other plugin and its data stay as they are. Then turn the long form into a funnel: spread its fields over steps on the canvas and give each answer its own path. Privacy and spam protection Your entries stay in your WordPress database. Funnelforms Free needs no account and sends nothing to Funnelforms unless you opt in to diagnostic data. Entries are deleted after the period you choose; personal data export and erasure work through the WordPress privacy tools. Spam protection without extra plugins: honeypot, time check and a limit per visitor, plus Google reCAPTCHA, Cloudflare Turnstile or hCaptcha if you want them. In your language Funnelforms Free comes in English and 24 translations: German (with “du” and “Sie”), Spanish, French, Italian, Portuguese (Brazil and Portugal), Dutch, Polish, Russian, Japanese, Chinese, Korean, Turkish, Swedish, Danish, Norwegian, Finnish, Czech, Hungarian, Romanian, Greek, Indonesian, Vietnamese and Persian. Funnelforms Pro Funnelforms Pro turns leads into appointments and sales. It is a separate plugin for the same forms. The launch trailer shows Funnelforms Pro 5.0 in two minutes: Funnelforms Pro adds: Lead board with the stages new, contacted, won and lost, notes on each lead and lead scoring. Appointment booking with your calendar, right in the form. Payments with Stripe and PayPal, calculations for prices and quotes, and quizzes. Reminders to visitors who leave a form before they send it. Integrations with CRM and newsletter tools, webhooks and text messages. Conditions with AND/OR, file upload, address suggestions and signatures, PDF, A/B tests, forms in several languages, analytics with sources and campaigns, and support by ticket. Funnelforms Free names what Pro adds on one page in its menu and, where a Pro feature would be, in one line with a link to that page. Nothing in Free is locked or time limited. More at funnelforms.io. Help Answers to most questions are in the Funnelforms help center. Questions about Funnelforms Free are welcome in the support forum. External services Funnelforms diagnostic data (only if you opt in) This plugin connects to api.funnelforms.cloud only if you opt in to diagnostic data, in the setup assistant or under Funnelforms > Settings > General > Diagnostic data. It is off by default. What: once a week a report with the plugin, WordPress and PHP versions, server environment, features and question types in use, counts (forms, entries, views), drop-off per question type and the times entries come in. It never sends texts, answers, entries, email or IP addresses of your visitors, form IDs or page addresses. The report carries a random installation ID; Funnelforms Free needs no account. The website’s address is sent only if you tick that box too. “View report” in the settings shows the report exactly as it would be sent. When: once a week at a random time, and once shortly after you opt in. Turning it off stops sending and asks Funnelforms to delete all stored reports of the installation; so does deleting the plugin. Where: api.funnelforms.cloud. Funnelforms LLC (Wyoming, USA) receives the reports on servers of Hetzner in Helsinki, Finland, and keeps them for 13 months. Terms: https://en.funnelforms.io/terms-conditions, privacy: https://en.funnelforms.io/privacy-policy Funnelforms tips and news by email (only if you sign up) What: the e-mail address you enter (your own address is filled in and can be changed), the language of the consent text (German, English, Spanish, French or Italian) and the version of the consent text you agreed to. Nothing about your site or your visitors. Funnelforms first sends one e-mail to confirm the sign-up (double opt-in); every e-mail has a link to unsubscribe. The plugin keeps only a note that the sign-up was sent, not the address. When: only when you tick “Tips and news by email” in the setup assistant and click to go on. Opening the assistant sends nothing: the consent text is part of the plugin. If Funnelforms has a newer text, the plugin loads it right after that click and shows it; nothing more is sent until you tick the box again. There are no retries in the background. Where: api.funnelforms.cloud, run by Funnelforms LLC (Wyoming, USA). Terms: https://en.funnelforms.io/terms-conditions, privacy: https://en.funnelforms.io/privacy-policy (German: https://www.funnelforms.io/datenschutzerklarung) Google Fonts What: the name of the font. No visitor data: the site downloads the font files once and serves them itself, so visitors never contact Google. When: when someone who edits forms picks a Google Font. Where: fonts.googleapis.com and fonts.gstatic.com. Terms: https://policies.google.com/terms, privacy: https://policies.google.com/privacy Spam protection (Google reCAPTCHA, Cloudflare Turnstile, hCaptcha) What: the visitor’s browser loads the script of the provider; on sending, the site sends the answer token and the visitor’s IP address to the provider to check it. When: only in forms with a captcha field and a key of the provider in the settings. Google reCAPTCHA: terms https://policies.google.com/terms, privacy https://policies.google.com/privacy Cloudflare Turnstile: terms https://www.cloudflare.com/policies/terms/, privacy https://www.cloudflare.com/privacypolicy/ hCaptcha: terms https://www.hcaptcha.com/terms, privacy https://www.hcaptcha.com/privacy Funnelforms account (only when you upgrade to Pro) What: nothing is sent in the background. The buttons on the page Funnelforms → Pro features open the account pages of Funnelforms in a new tab; the address of that page goes with the link, so the checkout can send you back to it. When: only when you click “Upgrade to Pro”, “No plan yet? Choose one” or “Open downloads in my account”. Where: api.funnelforms.cloud. Payments are handled by Stripe on its own checkout page. Terms: https://en.funnelforms.io/terms-conditions, privacy: https://en.funnelforms.io/privacy-policy Addresses you enter The end step redirects visitors to the address you enter, and images and downloads load from the addresses you choose. If you set up a mail server under Funnelforms > Settings > E-mail, the mails of Funnelforms go through that server, with the user name and password you enter there. Nothing is sent to it otherwise. Third-party code and icons Icons of answers and contact fields: Lucide (https://lucide.dev), ISC license, parts derived from Feather under the MIT license. The license text is in assets/icons/LICENSE.txt. Font Awesome Free icons for forms from version 3 (https://fontawesome.com), SIL OFL 1.1 for the font files and MIT for the CSS. Source code The scripts in assets/builder and assets/runtime are built and minified from TypeScript. The sources, with the build scripts, are in the folder source/ of this plugin. To build them: pnpm install and pnpm -r build in that folder (Node.js 20 or newer).

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C