Contact Form for WordPress – Ultimate Form Builder Lite

Contact Form for WordPress – Ultimate Form Builder Lite has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2018; all 3 are fixed as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high. 2017 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include SQL Injection.

Every one of the 3 issues recorded for Contact Form for WordPress – Ultimate Form Builder Lite has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

7.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Contact Form for WordPress – Ultimate Form Builder Lite vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2017-15919

Ultimate Form Builder Lite <= 1.3.6 - SQL Injection to PHP Object Injection

Read the full analysis

Vulnerability Records

3 records


2018-06-20 00:00	Ultimate Form Builder Lite <= 1.3.7 - Cross-Site Scripting Contact Form for WordPress <= 1.3.7	`N/A`	6.4 Medium	Neven Birusk	Yes
2017-10-23 00:00	Ultimate Form Builder Lite <= 1.3.6 - SQL Injection to PHP Object Injection Contact Form for WordPress < 1.3.7	`CVE-2017-15919`	9.8 Critical	Anonymous	Yes
2017-04-19 00:00	Ultimate Form Builder Lite <= 1.3.2 - Reflected Cross-Site Scripting Contact Form for WordPress < 1.3.3	`N/A`	6.1 Medium	0xSec Team	Yes

Showing 1–3 of 3 reports