Database for Contact Form 7, WPforms, Elementor forms

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 58% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

1. ★★★★★ sanjkaushal07

   5mo ago

   I was waiting for SMTP details for a long. Later I found that we can save these enteries into the database so I managed to install this plugin and cancelled the email sending at all. Now, I had the manual process but it was a pleasant to see all the leads with in wordpress. Later I automated the emails also. But it is still very pleasant experience while we can check all the enteries with in wordpress admin.

   Read on wp.org ↗
2. ★★★★★ Garth Penglase

   8mo ago

   I started using CRM Perks form plugin, after contact 7 started when it started regularly having caching issues and captcha issues, and associated anti-spam plugins weren’t doing the job. CRM Perks form plugin is excellent straight “out of the box” but has so many available options even in the free version and cleaned up my spam submission problems – so I naturally started using their associated DB plugin. And this also works very well, and caters for a range of other form plugins, which makes online viewing of submitted forms much easier and more standardised across all of our sites.

   Read on wp.org ↗
3. ★★★★★ davidtorresocana

   8mo ago

   It works well

   Read on wp.org ↗
4. ★★★★★ Bill

   10mo ago

   Quietly and efficiently doing the job day after day. Love it.

   Read on wp.org ↗
5. ★★★★★ pauleyq

   1.0y ago

   Here in Finland, there’s an old saying: “toimii kuin junan vessa,” literally “works like a train toilet.”It means something works reliably and without problems. Simple, effective, and always does the job. Thanks!

   Read on wp.org ↗
6. ★★★★★ georg.r

   1.1y ago

   First I was a little confused because there where only a few fields visible in the overview (coming from another plugin). Then I realized I can blend them in in the “Screen Options”. Its nice to see the important field in the overview and not have to enter the “Detail” view.

   Read on wp.org ↗
7. ★★★★★ melvinbk

   1.1y ago

   Plugin vraiment super, merci

   Read on wp.org ↗
8. ★★★★★ s3eed

   1.1y ago

   very good to see ,export data from

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.5.5 fixed “sql injection issue” with data->lead_actions function. 1.5.5
2. — Version 1.5.4 fixed invalid file urls issue. fixed “empty page on updating entry” issue. 1.5.4
3. — Version 1.5.3 fixed XSS issue with $form_id in screen options of leads page. 1.5.3
4. — Version 1.5.2 fixed “Unauthenticated Arbitrary File Deletion” issue. 1.5.2
5. — Version 1.5.1 fixed “elementor form fields” issue. 1.5.1
6. — Version 1.5.0 fixed “Missing Authorization to Authenticated wp users” issue. 1.5.0

20 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.5 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.4 - Authenticated (Authenticated+) SQL Injection ↗
   2026-07-27 CVE-2026-14872 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.5.4 Patched in 1.5.5
2. High · 7.2 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-10 CVE-2026-57708 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.2 Patched in 1.5.3
3. Medium · 6.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Reflected Cross-Site Scripting ↗
   2026-07-07 CVE-2026-14870 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.2 Patched in 1.5.3
4. Medium · 6.5 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value' ↗
   2026-07-01 CVE-2026-9145 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.5.1 Patched in 1.5.2
5. High · 8.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection ↗
   2026-06-22 CVE-2026-12081 Deserialization of Untrusted Data Affects <= 1.5.1 Patched in 1.5.2
6. High · 8.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value ↗
   2026-06-19 CVE-2026-9843 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.5.1 Patched in 1.5.2
7. Medium · 4.3 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode ↗
   2026-03-31 CVE-2026-3831 Missing Authorization Affects <= 1.4.9 Patched in 1.5.0
8. Critical · 9.8 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv' ↗
   2026-03-04 CVE-2026-2599 Deserialization of Untrusted Data Affects <= 1.4.7 Patched in 1.4.8
9. Medium · 5.3 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export ↗
   2026-01-27 CVE-2026-0825 Missing Authorization Affects <= 1.4.5 Patched in 1.4.6
10. Critical · 9.8 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion ↗
    2025-08-12 CVE-2025-7384 Deserialization of Untrusted Data Affects <= 1.4.3 Patched in 1.4.4
11. High · 7.2 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-04-22 CVE-2024-3715 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.8 Patched in 1.3.9
12. Medium · 6.4 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-03-06 CVE-2024-2030 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.3 Patched in 1.3.4
13. High · 7.2 Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload ↗
    2024-01-30 CVE-2024-1069 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.2 Patched in 1.3.3
14. High · 8.8 Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode ↗
    2023-05-22 CVE-2023-31212 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 1.3.0 Patched in 1.3.1
15. Medium · 6.4 Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode ↗
    2023-05-22 CVE-2023-33311 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.3.0 Patched in 1.3.1
16. High · 7.2 Contact Form Entries <= 1.2.9 - CSV Injection ↗
    2022-10-21 CVE-2022-3604 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.2.9 Patched in 1.3.0
17. Medium · 6.1 Contact Form Entries <= 1.2.3 - Reflected Cross-Site Scripting ↗
    2021-11-14 CVE-2021-25079 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.3 Patched in 1.2.4
18. Medium · 6.1 CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting ↗
    2021-08-26 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.1 Patched in 1.2.2
19. Medium · 6.1 Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting ↗
    2021-08-24 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.0 Patched in 1.2.1
20. High · 7.2 Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting ↗
    2021-01-05 CVE-2021-25080 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.1.6 Patched in 1.1.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-16 70K+ → 60K+ down after 67 days in tier
2. 2026-03-10 60K+ → 70K+ up after 25 days in tier
3. 2026-02-13 70K+ → 60K+ down after 667 days in tier
4. 2024-04-17 60K+ → 70K+ up after 334 days in tier
5. 2023-05-19 50K+ → 60K+ up after 216 days in tier
6. 2022-10-15 40K+ → 50K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• EP Exporter for Contact Form 7 (CF7) 500+ installs · 4.0★ · 2 shared tags B
• Contact Form 7 Database Manager Addon – CF7DBM 200+ installs · 4.0★ · 2 shared tags C
• Database Addon for Contact Form 7 – CFDB7 600K+ installs · 5.0★ · 1 shared tag A
• Redirection for Contact Form 7 200K+ installs · 4.7★ · 1 shared tag A
• ReCaptcha v2 for Contact Form 7 200K+ installs · 4.8★ · 1 shared tag A
• Conditional Fields for Contact Form 7 100K+ installs · 4.7★ · 1 shared tag A

Embed this report card

Drop a live Pulse card for Database for Contact Form 7, WPforms, Elementor forms into a readme, a review or a deck. It updates itself.

Database for Contact Form 7, WPforms, Elementor forms: 60K+ active installs, 4.8★ (124 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/contact-form-entries