Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · formcraft-form-builder
FormCraft
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Jul 23, 2026FormCraft: Stored Cross-Site ScriptingCVE-2026-7232 · affects up to 3.9.14 · reported by WordfenceHigh 7.2
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combines a server-side gap — where composite matrix sub-field keys such as field2_0 and field2_1 are never passed through the sanitization loop and are stored raw via $wpdb->insert() — with a client-side gap where DOMPurify is only invoked when typeof field.value === 'string', but matrix values arrive from the server as arrays, bypassing the check before being mapped to strings and injected into the DOM. Additionally, the same sink is reachable via a second attack vector: array-typed field values are passed through htmlentities() on submission but later reversed by html_entity_decode() at formcraft-main.php:2608 and :2122, restoring the malicious payload before storage and rendering.
Feb 18, 2025FormCraft: Stored Cross-Site ScriptingCVE-2025-0817 · affects up to 3.9.11 · reported by WordfenceHigh 7.2
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Feb 18, 2025FormCraft: Unauthorized access of dataCVE-2024-13783 · affects up to 3.9.11 · reported by WordfenceMedium 4.3
The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in all versions up to, and including, 3.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to export all plugin data which may contain sensitive information from form submissions.
Dec 9, 2024FormCraft: Missing AuthorizationCVE-2023-47823 · affects up to 1.2.7 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.7.
Nov 1, 2024FormCraft: Missing AuthorizationCVE-2024-43157 · affects up to 1.2.10 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10.
Aug 30, 2023FormCraft: Does not sanitise and escape some of its settingsCVE-2023-3501 · fixed in 1.2.7 · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Jun 27, 2023FormCraft: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-2592 · fixed in 3.9.7 · reported by WPScanHigh 7.2
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
May 15, 2023Auth.CVE-2023-22717 · affects up to 1.2.6 · reported by PatchstackMedium 6.5
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in nCrafts FormCraft plugin <= 1.2.6 versions.
Jun 8, 2022FormCraft: Does not sanitise and escape Field LabelsCVE-2022-1647 · fixed in 1.2.6 · reported by WPScanMedium 4.8
The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Mar 21, 2022FormCraft: Does not validate the URL parameter in the formcraft3_get AJAX actionCVE-2022-0591 · fixed in 3.8.28 · reported by WPScanCritical 9.1
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Aug 16, 2019The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.CVE-2019-15114 · fixed in 1.2.2 · reported by MITREHigh 8.8
The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF.
Mar 12, 2019FormCraft 1.2.1 and earlier: Cross-site request forgery (CSRF)CVE-2019-5920 · affects up to 1.2.1 · reported by vultures@jpcert.or.jpHigh 8.8
Cross-site request forgery (CSRF) vulnerability in FormCraft 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators via a specially crafted page.
Dec 20, 2013SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via thCVE-2013-7187 · affects up to 1.3.7 · reported by MITREHigh 7.5
SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.