WS Form LITE – Drag & Drop Contact Form Builder

WS Form LITE – Drag & Drop Contact Form Builder has 11 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 11 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2024 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (45%). Other recurring categories include Missing Authorization, Client-Side Enforcement Of Server-Side Security.

Every one of the 11 issues recorded for WS Form LITE – Drag & Drop Contact Form Builder has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (2) reported by Felipe Restrepo Rodriguez (pfelilpe). WS Form LITE – Drag & Drop Contact Form Builder is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.1/ 10
Patch Coverage100%
Open

0

Fixed

11

Get automatic notifications for all WS Form LITE – Drag & Drop Contact Form Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-4703

WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission

Read the full analysis

Vulnerability Records

11 records
2026-08-21 00:00CVE-2026-4703
9.8
Critical
Athiwat Tiprasaharn (Jitlada)Yes
2026-07-10 00:00CVE-2026-11562
4.3
Medium
Mustafa AhmedYes
2025-04-24 00:00CVE-2025-3912
5.3
Medium
Amin BeheshtiYes
2025-01-27 00:00CVE-2024-13509
7.2
High
Tim CoenYes
2024-11-05 00:00CVE-2024-10647
6.1
Medium
Peter ThaleikisYes
2024-09-25 00:00CVE-2024-47320
6.1
Medium
SavPhill (Savphill)Yes
2024-06-06 00:00CVE-2023-5424
4.7
Medium
Duc ManhYes
2023-12-28 00:00CVE-2023-52135
6.6
Medium
Muhammad DaffaYes
2023-05-23 00:00N/A
5.3
Medium
AnonymousYes
2022-01-31 00:00CVE-2022-23987
4.8
Medium
Felipe Restrepo Rodriguez (pfelilpe)Yes
Showing 1–10 of 11 reports
WS Form LITE – Drag & Drop Contact Form Builder banner
Latestv1.12.10

WS Form LITE – Drag & Drop Contact Form Builder

Mark Westguard

Author

Mark Westguard

5.0(321)
100/100
Last Updated
2026-09-09 (4d ago)
Active Installs
10,000+
Downloads
472,635
Requires WP
5.5+
Requires PHP
7.2+
Tested up to
WP 7.1
Created
2018-09-21 (8y ago)

Create Professional, Mobile-Friendly, Accessible Forms for WordPress – For Free! WS Form LITE is a powerful, feature-rich form builder that lets you create fully styled, responsive, and accessible forms. Unlike other plugins, WS Form LITE includes premium-quality features at no cost, such as unlimited forms, customizable styling, submission exporting, and robust anti-spam protection. Perfect for websites of all sizes, WS Form LITE empowers you to build smarter forms with ease. Choose from single-click templates or build your own form for WordPress using the unique drag and drop form editor. Create Beautiful Forms with Ease WS Form LITE includes an incredibly powerful and intuitive form styler, enabling you to design stunning forms directly within WordPress. Whether you’re matching your site’s branding or building custom layouts from scratch, WS Form’s Styler gives you full control over the appearance of your forms, no coding required. Included Features Unlimited Forms Unlimited Submissions Unlimited Styles Accessibility Friendly CaptchaFox Clean HTML 5 Code Cloudflare Turnstile Captcha Data Sources Drag and Drop Layout Editor Elementor Angie Integration Framework Friendly (Bootstrap, Foundation) GDPR Ready Google reCAPTCHA hCaptcha MCP Server Mobile Friendly Multiple Tab Forms Responsive Forms Section Library Send Unlimited Emails Single Click Templates Styler Translation Variables How to Create a Form in WordPress Go to WS Form > Add New. Choose a template or start from a blank form. Use the drag-and-drop editor to add fields. Click “Publish” and embed the form using your preferred page builder. Page Builders Add forms to your website using your favorite WordPress page builder: Beaver Builder Block Editor (Gutenberg) Breakdance Bricks Classic Editor Divi 4 Divi 5 Elementor Etch Oxygen For other builders simply use the WS Form shortcode! Spam Protection WS Form includes a powerful, multi-layer spam protection system to block unwanted submissions automatically. You get both built-in defenses and integrations with leading anti-spam services. Built-in Defenses Honeypot to silently trap bots WordPress NONCE validation Field validation (client-side and server-side) Duplicate submission detection and blocking IP rate limiting and throttling Keyword, domain, user agent, and IP blocking rules Optional server-side custom validation hooks Anti-Spam Fields and Integrations AbuseIPDB Akismet CaptchaFox Clearout Cloudflare Turnstile Google reCAPTCHA hCaptcha Works alongside third-party services such as CleanTalk and OOPSpam Multilingual Forms and Translation Translate your forms using your favorite multilingual plugin, or create different forms per language: Polylang TranslatePress Weglot WPML Manual translation Upgrade to PRO This plugin is the free LITE edition of WS Form PRO. The PRO edition comes with unrivaled additional features: 65+ Feature Rich Field Types Calculated Fields Cascading Select, Checkbox and Radio Fields Conditional Logic Conversational Forms Data Encryption Debug Console E-Commerce Repeatable Sections Save Progress Signatures Statistics Track Visitors … and more! Upgrade to WS Form PRO. PRO Integrations Airtable Akismet Amazon S3 AutomatorWP ActiveCampaign Authorize.Net Accept AWeber Bento Brevo (Sendinblue) Campaign Monitor Clearout Constant Contact ConvertKit dotdigital Drip Dropbox Fluent CRM Freshdesk GetResponse Google Address Google Drive Google Map Google Sheets Groundhogg HighLevel HubSpot iContact InstaWP Klaviyo Laposta LeadConnector Mailchimp MailerLite MailPoet Mailster Make Modula Mollie Moosend Notion OpenAI PayPal Checkout PDF Pipedrive Post Management Salesforce Slack Stripe Elements Twilio User Management Webex WooCommerce WP Fusion Zapier Zendesk Zoho CRM …. or use the Webhook action to integrate with your own custom APIs or external systems. PRO Custom Field Plugin Compatibility ACF ACPT JetEngine Meta Box Pods Toolset Theme / Framework Support WS Form is compatible with all WordPress themes, and also outputs native HTML for the following front-end frameworks: Bootstrap 5+ Bootstrap 4.1-4.5.x Bootstrap 4.0 Bootstrap 3.x Foundation 6.4+ Foundation 6.0-6.3.1 Foundation 5.x Performance WS Form was built with enterprise level performance in mind. WS Form does not interfere with the loading of other page or post content on your website and isolates submission records to ensure as your website grows your page load speed is not affected. All form code is HTML 5 compliant and if your website theme uses a framework such as Bootstrap or Foundation WS Form automatically outputs code to suit that framework. This means your form loads as fast as possible without any unnecessary overhead typically found in other form plugins for WordPress. Click here to learn more about the WSForm performance features. Extensive Field Types WS Form comes complete with all the field types you need to build a contact form. Upgrade to WS Form PRO to take advantage of all the form field types available, including: Color Picker Date / Time File Upload Google Address Google Map Google Routing hCaptcha HTML Legal Media Capture (Includes QR code reader) Message Previous Tab / Next Tab Price Progress Bar Range Slider Rating reCAPTCHA Save Signature Validation … and more! For Developers WS Form PRO comes with a unique debug console that provides you with rapid, form population capabilities (perfect for form testing!), as well as comprehensive event and error logging. 3rd Party Use WS Form includes the following third party components: Date Format by Jacob Wright – Used for formatting server and post dates on the public JavaScript interface. Intl-Tel-Input – Used for international telephone input Select2 – Used for AJAX select dropdowns CanIUse.com – Used for linking to field and field attribute compatibility pages Coloris – Used for the color picker in the styler External Services WS Form uses the following API endpoints to provide services within the plugin: AbuseIPDB https://api.abuseipdb.com/api/v2/ This endpoint is called when AbuseIPDB spam protection is enabled to check the submitter IP address, and optionally to report an IP when a submission is marked as spam. Terms of Use / Privacy Policy CaptchaFox https://api.captchafox.com/siteverify This endpoint is called when a form is submitted to validate a CaptchaFox field. Terms of Use / Privacy Policy Google reCaptcha https://www.google.com/recaptcha/api/siteverify This endpoint is called when a form is submitted to validate a reCaptcha field. Terms of Use / Privacy Policy hCaptcha https://hcaptcha.com/siteverify This endpoint is called when a form is submitted to validate an hCaptcha field. Terms of Use / Privacy Policy Turnstile https://challenges.cloudflare.com/turnstile/v0/siteverify This endpoint is called when a form is submitted to validate a Turnstile field. Terms of Use / Privacy Policy WS Form – Knowledge base popular articles https://wsform.com/plugin-support/knowledgebase_content.php This endpoint is called when the support sidebar is opened to show popular knowledge base articles. Terms of Use / Privacy Policy WS Form – Knowledge base search https://wsform.com/plugin-support/knowledgebase_search.php This endpoint is called when a knowledge base search is performed in the support sidebar to return knowledge article results. Terms of Use / Privacy Policy WS Form – Support ticket requests https://wsform.com/plugin-support/contact.php This endpoint is called when a support ticket request is submitted in the support sidebar to create the support ticket and return the ticket ID. Terms of Use / Privacy Policy WS Form – Deactivation feedback requests https://wsform.com/plugin-support/deactivate_feedback.php This endpoint is called when deactivation feedback is submitted to provide your feedback to WS Form. Terms of Use / Privacy Policy WS Form – Select, checkbox and radio presets https://cdn.wsform.com/plugin-support/preset.json This endpoint is called when the preset option is selected for a select, checkbox or radio field to return the available presets and preset data (e.g. List of countries). Terms of Use / Privacy Policy Support Need help? Check out our extensive knowledge base. For support, please visit the WS Form LITE support forum.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C