Simple Contact Forms

Simple Contact Forms has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

None of the 2 issues recorded for Simple Contact Forms have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

2 independent researchers contributed these findings, one record each. Simple Contact Forms is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.6.30.

Strategic Overview

Avg CVSSMedium
6.2/ 10
Patch Coverage0%
Open

2

Fixed

0

Get automatic notifications for all Simple Contact Forms vulnerabilities before they are exploited.

Most severe open issueCVSS 8.1CVE-2025-60197

Simple Contact Forms <= 1.6.4 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

2 records
Simple Contact Forms banner
Latestv1.6.4

Simple Contact Forms

owenr88

Author

owenr88

5.0(1)
100/100
Last Updated
2016-10-03 (10y ago)
Active Installs
20+
Downloads
5,025
Requires WP
3.8+
Requires PHP
0+
Tested up to
WP 4.6.30
Created
2015-07-08 (11y ago)

Simple Contact Forms is designed to strip all the hassle so you can insert contact forms where you want and how you want. It’s incredibly simple to set up and use so you can spend more time working on the harder parts of your site. Dropping Simple Contact Forms into your site allows users to complete your forms and interact with your site. A successful completion will trigger an email notification to you and create a record in the database, which is viewable in the WordPress Admin area (can also be exported by CSV). Build your own contact forms with a number of configurable drag and drop fields. Fields can also be required for successful submission or excluded completely to be saved for later. The fields include: Plain text – Normal, Name and Email Address specific Textarea Checkboxe – Single or Multiple Dropdowns – Multiple Options The plugin also has a number of options configurable in the WordPress admin area. These include: Form Titles Form Styling (Bootstrap only for now) Form Validation (reCAPTCHA and Maths test) Form Collapsable by a button Submit Button Text Button Text & Icon Button Styling Destination Pages Email Address for Notification Email Subject for Notification Error Message Content Success Message Content Simple Contact Forms was created and is managed by Big Lemon Creative.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C