Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 67% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ nemwang

   2.7y ago

   it shows an error when other user roles like editor, author , subscriber or any other roles except administrator tries to upload the media or attch file to it. But for admin roles its a perfect to upload any post from frontend but whats the use of plugin if it works only for admin role.

   Read on wp.org ↗
2. ★★★★★ bigcheesez

   3.0y ago

   too much stuff added that are pro features. if i want to buy rhe plugin i will.

   Read on wp.org ↗
3. ★★★★★ marcos8

   3.4y ago

   É joia, os recursos básicos já atenderam as expectativas. This topic was modified 3 years, 3 months ago by marcos8.

   Read on wp.org ↗
4. ★★★★★ kaotai05

   3.5y ago

   I like buddyforms very much. It is the best form-builder I have ever seen. Support is perfectly and fast.

   Read on wp.org ↗
5. ★★★★★ sirhc

   3.5y ago

   There are very few plugins that can do what this does, let users submit information for the front end but also can keep it private. Very easy to use! I found some limitations but notified support who quickly fixed them. My only constructive feedback is for support to respond more quickly, that’s what will turn a free user into a paid one (in my case eventually I was able to communicate more directly with support through slack and believe they will be more responsive for others) This topic was modified 3 years, 4 months ago by sirhc.

   Read on wp.org ↗
6. ★★★★★ Joanni Davis

   3.7y ago

   Great. Thank you for making this course available online. I look forward to more.

   Read on wp.org ↗
7. ★★★★★ isbgonlin

   4.3y ago

   It`s easy to use and it gives you a lot of different options and functionality to build your forms.

   Read on wp.org ↗
8. ★★★★★ mrinalkanti99

   4.4y ago

   This is a very helpful plugin. The Ultimate Memeber extension is helping me a lot. And moderation extension also.

   Read on wp.org ↗

20 disclosed vulnerabilities on record for this plugin, 2 still affect the current version.

1. Medium · 5.3 BuddyForms <= 2.9.0 - Missing Authorization ↗
   2025-10-19 CVE-2025-62973 Missing Authorization Affects <= 2.9.0 No patch available
2. High · 8.8 BuddyForms <= 2.8.17 - Authenticated (Contributor+) Local File Inclusion ↗
   2025-04-04 CVE-2025-32151 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Affects <= 2.8.17 No patch available
3. Medium · 6.4 Frontend Content Forms for User Submissions (UGC) <= 2.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode ↗
   2025-02-21 CVE-2024-12038 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.15 Patched in 2.8.16
4. Medium · 6.4 Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2025-01-30 CVE-2024-12037 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.13 Patched in 2.8.14
5. Medium · 4.4 BuddyForms <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting ↗
   2024-09-30 CVE-2024-47377 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.12 Patched in 2.8.13
6. High · 8.8 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.11 - Authenticated (Contributor+) Privilege Escalation ↗
   2024-09-13 CVE-2024-8246 Improper Privilege Management Affects <= 2.8.11 Patched in 2.8.12
7. Medium · 6.5 BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness ↗
   2024-06-04 CVE-2024-5149 Use of Insufficiently Random Values Affects <= 2.8.9 Patched in 2.8.10
8. Critical · 9.3 BuddyForms <= 2.8.8 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery ↗
   2024-04-22 CVE-2024-32830 Server-Side Request Forgery (SSRF) Affects <= 2.8.8 Patched in 2.8.9
9. Medium · 6.1 BuddyForms <= 2.8.5 - Reflected Cross-Site Scripting via page ↗
   2024-03-25 CVE-2024-30198 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.5 Patched in 2.8.6
10. Medium · 4.3 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization ↗
    2024-03-06 CVE-2024-1158 Missing Authorization Affects <= 2.8.7 Patched in 2.8.8
11. High · 8.2 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion ↗
    2024-03-06 CVE-2024-1170 Missing Authorization Affects <= 2.8.7 Patched in 2.8.8
12. High · 7.5 Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload ↗
    2024-03-06 CVE-2024-1169 Missing Authorization Affects <= 2.8.7 Patched in 2.8.8
13. Medium · 6.1 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get ↗
    2023-07-18 CVE-2023-33999 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.2 Patched in 2.8.3
14. Medium · 6.4 Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ↗
    2023-05-11 CVE-2023-25981 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.8.1 Patched in 2.8.2
15. High · 8.8 BuddyForms <= 2.7.7 - PHAR Deserialization ↗
    2023-02-20 CVE-2023-26326 Deserialization of Untrusted Data Affects <= 2.7.7 Patched in 2.7.8
16. Medium · 6.4 BuddyForms <= 2.7.2 - Authenticated (Contributor+) Stored Stored Cross-Site Scripting ↗
    2022-10-27 CVE-2022-38971 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.7.2 Patched in 2.7.3
17. Medium · 6.1 Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.6.9 - Cross-Site Scripting ↗
    2022-06-26 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.6.9 Patched in 2.6.10
18. Medium · 6.3 Freemius SDK <= 2.4.2 - Missing Authorization Checks ↗
    2022-03-04 CVE-2022-4974 Missing Authorization Affects < 2.6.3 Patched in 2.6.3
19. High · 8.8 Freemius SDK <= 2.2.3 - Missing Authorization to Arbitrary Options Update ↗
    2019-02-25 Missing Authorization Affects < 2.3.2 Patched in 2.3.2
20. Critical · 9.8 Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.2.7 - SQL Injection ↗
    2018-11-09 CVE-2018-21003 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 2.2.7 Patched in 2.2.8

Automated install-time checks, tested on PHP 8.1.12 · WP 6.8.1

Translated into 8 languages, 0 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-18 1K+ → 900+ down after 1025 days in tier
2. 2023-08-28 2K+ → 1K+ down after 5 days in tier
3. 2023-08-23 1K+ → 2K+ up after 1 days in tier
4. 2023-08-22 2K+ → 1K+ down after 8 days in tier
5. 2023-08-14 1K+ → 2K+ up after 2 days in tier
6. 2023-08-12 2K+ → 1K+ down after 2 days in tier
7. 2023-08-10 1K+ → 2K+ up after 3 days in tier
8. 2023-08-07 2K+ → 1K+ down after 2 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 3 shared tags A
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 3 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 3 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 3 shared tags A
• Ultra Addons for Contact Form 7 60K+ installs · 4.7★ · 3 shared tags A
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder 20K+ installs · 4.2★ · 3 shared tags A

Embed this report card

Drop a live Pulse card for Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) into a readme, a review or a deck. It updates itself.

Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC): 900+ active installs, 4.8★ (180 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/buddyforms