Contact Form Widget – Responsive Contact Form, Query Form & Form Builder
Contact Form Widget – Responsive Contact Form, Query Form & Form Builder has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2019 and 2025; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 5.2, and the most serious one scores 8.0 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 3 of the records (60%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, SQL Injection.
4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.
5 independent researchers contributed these findings, one record each. Contact Form Widget – Responsive Contact Form, Query Form & Form Builder is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-62134Contact Form Widget <= 1.5.1 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Contact Form Widget – Responsive Contact Form, Query Form & Form Builder
Author
A WP Life
Contact Form Widget is a lightweight, responsive contact form plugin for WordPress designed to collect user inquiries, leads, and customer feedback effortlessly. Whether you need a simple sidebar contact form widget or a full-width contact form shortcode inside your posts and pages, this contact form plugin provides an intuitive setup with complete administrative control. Unlike basic contact form tools that rely solely on email notifications, every contact form submission sent through this plugin is saved directly to your WordPress database. You can manage, review, and organize all incoming messages inside a dedicated admin query dashboard, ensuring you never miss a visitor inquiry or client lead. View Pro Demo: Contact Form Premium Demo More About Pro: Contact Form Premium Details Try Pro Version: Test Premium Plugin Why Choose This Contact Form Plugin? Building a functional contact form should be straightforward. This plugin combines the simplicity of a drag-and-drop contact form widget with the flexibility of a shortcode-based form builder. It handles real-time AJAX form validation, protects submissions with security nonces, and offers custom design controls so your contact form matches your site branding seamlessly. Key Features of Contact Form Widget Stored Contact Queries – Automatically saves every contact form message in your database table for easy tracking and record keeping. Dual Display Options – Embed your contact form using the shortcode [CFW] or place it in any sidebar or footer widget area. Asynchronous AJAX Submission – Visitors can submit the contact form instantly without page reloads, complete with loading spinners and inline confirmation notices. Pre-Built Layout Templates – Select between Template 1 (classic centered layout) and Template 2 (modern two-column grid layout for Name and Email). Full Design Customization – Adjust form background color, title color, max-width slider (10% to 100%), and container alignment (left, center, right). Custom Field Placeholders – Customize text labels and placeholder prompts for Name, Email, Subject, and Message fields. Custom Error & Success Messages – Tailor validation error alerts for blank inputs or invalid email addresses, as well as submission response messages. Custom CSS Editor – Add your own custom CSS styling directly from the settings panel to tweak form appearances without editing theme files. CSV Export Tool – Export all stored contact form queries into a structured CSV file for offline reporting and customer relationship management. Admin Query Dashboard – Sort, paginate (5 to 250 records per page), view details in a popup modal, and delete single or bulk form entries. Pro Features Upgrade to Contact Form Premium for enhanced control and advanced form building capabilities: Google reCAPTCHA Integration – Block spam submissions and automated bots. SMTP Email Support – Deliver notifications reliably via Gmail or custom SMTP servers. Auto Email Responder – Send automatic reply emails to visitors after contact form submission. Custom Email Templates – Personalize administrative and user notification emails. Submission Analytics – View daily form submission trends and statistical reports. Priority Premium Support – Access dedicated support from our technical team.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C