Multilang Contact Form

Multilang Contact Form has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; 1 is fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

1 of the records (50%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. Multilang Contact Form is installed on roughly 50 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

5.2/ 10

Patch Coverage50%

Open

Fixed

Get automatic notifications for all Multilang Contact Form vulnerabilities before they are exploited.

Most severe open issueCVSS 6.1CVE-2025-22795

Multilang Contact Form <= 1.5 - Reflected Cross-Site Scripting

Read the full analysis

Vulnerability Records

2 records


2025-09-26 00:00	Multilang Contact Form <= 1.5 - Cross-Site Request Forgery Multilang Contact Form <= 1.5	`CVE-2025-62896`	4.3 Medium	Nguyen Xuan Chien	Yes
2025-01-13 00:00	Multilang Contact Form <= 1.5 - Reflected Cross-Site Scripting Multilang Contact Form <= 1.5	`CVE-2025-22795`	6.1 Medium	LVT-tholv2k	No

Showing 1–2 of 2 reports

Plugin Profile

Latestv1.6

Multilang Contact Form

Author

digitaldonkey

0.0(0)

0/100

Last Updated

2026-07-02 (2mo ago)

Active Installs

50+

Downloads

12,474

Requires WP

2.5+

Requires PHP

8.2+

Tested up to

WP 7.0.4

Created

2010-09-04 (16y ago)

Multilang Contact Form is a very simple and easy contact form compatible with qtranslate. It can be implemented on a page or a post. Optionally you can enable reCapture against spam. Outdated, but updated: There are surely better contact forms.

View on WordPress.org