Simple Contact Forms
Simple Contact Forms has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; none of them are fixed as of September 2026. Their average CVSS score is 6.2, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.
None of the 2 issues recorded for Simple Contact Forms have a published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
2 independent researchers contributed these findings, one record each. Simple Contact Forms is installed on roughly 20 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 4.6.30.
CVE-2025-60197Simple Contact Forms <= 1.6.4 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records

Simple Contact Forms
Author
owenr88
Simple Contact Forms is designed to strip all the hassle so you can insert contact forms where you want and how you want. It’s incredibly simple to set up and use so you can spend more time working on the harder parts of your site. Dropping Simple Contact Forms into your site allows users to complete your forms and interact with your site. A successful completion will trigger an email notification to you and create a record in the database, which is viewable in the WordPress Admin area (can also be exported by CSV). Build your own contact forms with a number of configurable drag and drop fields. Fields can also be required for successful submission or excluded completely to be saved for later. The fields include: Plain text – Normal, Name and Email Address specific Textarea Checkboxe – Single or Multiple Dropdowns – Multiple Options The plugin also has a number of options configurable in the WordPress admin area. These include: Form Titles Form Styling (Bootstrap only for now) Form Validation (reCAPTCHA and Maths test) Form Collapsable by a button Submit Button Text Button Text & Icon Button Styling Destination Pages Email Address for Notification Email Subject for Notification Error Message Content Success Message Content Simple Contact Forms was created and is managed by Big Lemon Creative.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C