Database for Contact Form 7, WPforms, Elementor forms

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

174 searches this plugin appeared in over the last 90 days, 20 listed. 92 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 58% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 6 months ago; a band this size takes about a year or more to cross, which places it about 54% of the way through.

1. ★★★★★ sanjkaushal07

   7mo ago

   I was waiting for SMTP details for a long. Later I found that we can save these enteries into the database so I managed to install this plugin and cancelled the email sending at all. Now, I had the manual process but it was a pleasant to see all the leads with in wordpress. Later I automated the emails also. But it is still very pleasant experience while we can check all the enteries with in wordpress admin.

   Read on wp.org ↗
2. ★★★★★ Garth Penglase

   10mo ago

   I started using CRM Perks form plugin, after contact 7 started when it started regularly having caching issues and captcha issues, and associated anti-spam plugins weren’t doing the job. CRM Perks form plugin is excellent straight “out of the box” but has so many available options even in the free version and cleaned up my spam submission problems – so I naturally started using their associated DB plugin. And this also works very well, and caters for a range of other form plugins, which makes online viewing of submitted forms much easier and more standardised across all of our sites.

   Read on wp.org ↗
3. ★★★★★ davidtorresocana

   11mo ago

   It works well

   Read on wp.org ↗
4. ★★★★★ Bill

   12mo ago

   Quietly and efficiently doing the job day after day. Love it.

   Read on wp.org ↗
5. ★★★★★ pauleyq

   1.2y ago

   Here in Finland, there’s an old saying: “toimii kuin junan vessa,” literally “works like a train toilet.”It means something works reliably and without problems. Simple, effective, and always does the job. Thanks!

   Read on wp.org ↗
6. ★★★★★ georg.r

   1.3y ago

   First I was a little confused because there where only a few fields visible in the overview (coming from another plugin). Then I realized I can blend them in in the “Screen Options”. Its nice to see the important field in the overview and not have to enter the “Detail” view.

   Read on wp.org ↗
7. ★★★★★ melvinbk

   1.3y ago

   Plugin vraiment super, merci

   Read on wp.org ↗
8. ★★★★★ s3eed

   1.3y ago

   very good to see ,export data from

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 1.5.5 fixed “sql injection issue” with data->lead_actions function. 1.5.5
2. — Version 1.5.4 fixed invalid file urls issue. fixed “empty page on updating entry” issue. 1.5.4
3. — Version 1.5.3 fixed XSS issue with $form_id in screen options of leads page. 1.5.3
4. — Version 1.5.2 fixed “Unauthenticated Arbitrary File Deletion” issue. 1.5.2
5. — Version 1.5.1 fixed “elementor form fields” issue. 1.5.1
6. — Version 1.5.0 fixed “Missing Authorization to Authenticated wp users” issue. 1.5.0

All 20 disclosed vulnerabilities are patched in the current version (1.5.5). Sites still on an older version should update.

1. Patched Medium · 6.5 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.4 - Authenticated (Authenticated+) SQL Injection ↗
   2026-07-27 CVE-2026-14872 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.5.4 Patched in 1.5.5
2. Patched High · 7.2 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting ↗
   2026-07-10 CVE-2026-57708 Improper Neutralization of Input During Web Page Generation Affects <= 1.5.2 Patched in 1.5.3
3. Patched Medium · 6.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Reflected Cross-Site Scripting ↗
   2026-07-07 CVE-2026-14870 Improper Neutralization of Input During Web Page Generation Affects <= 1.5.2 Patched in 1.5.3
4. Patched Medium · 6.5 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Copy/Upload via Elementor Pro Form Upload Field 'raw_value' ↗
   2026-07-01 CVE-2026-9145 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.5.1 Patched in 1.5.2
5. Patched High · 8.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated PHP Object Injection ↗
   2026-06-22 CVE-2026-12081 Deserialization of Untrusted Data Affects <= 1.5.1 Patched in 1.5.2
6. Patched High · 8.1 Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value ↗
   2026-06-19 CVE-2026-9843 Improper Limitation of a Pathname to a Restricted Directory Affects <= 1.5.1 Patched in 1.5.2
7. Patched Medium · 4.3 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode ↗
   2026-03-31 CVE-2026-3831 Missing Authorization Affects <= 1.4.9 Patched in 1.5.0
8. Patched Critical · 9.8 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.7 - Unauthenticated PHP Object Injection via 'download_csv' ↗
   2026-03-04 CVE-2026-2599 Deserialization of Untrusted Data Affects <= 1.4.7 Patched in 1.4.8
9. Patched Medium · 5.3 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export ↗
   2026-01-27 CVE-2026-0825 Missing Authorization Affects <= 1.4.5 Patched in 1.4.6
10. Patched Critical · 9.8 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion ↗
    2025-08-12 CVE-2025-7384 Deserialization of Untrusted Data Affects <= 1.4.3 Patched in 1.4.4
11. Patched High · 7.2 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting ↗
    2024-04-22 CVE-2024-3715 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.8 Patched in 1.3.9
12. Patched Medium · 6.4 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ↗
    2024-03-06 CVE-2024-2030 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.3 Patched in 1.3.4
13. Patched High · 7.2 Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload ↗
    2024-01-30 CVE-2024-1069 Unrestricted Upload of File with Dangerous Type Affects <= 1.3.2 Patched in 1.3.3
14. Patched High · 8.8 Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) SQL Injection via shortcode ↗
    2023-05-22 CVE-2023-31212 Improper Neutralization of Special Elements used in an SQL Command Affects <= 1.3.0 Patched in 1.3.1
15. Patched Medium · 6.4 Contact Form Entries <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via vx-entries shortcode ↗
    2023-05-22 CVE-2023-33311 Improper Neutralization of Input During Web Page Generation Affects <= 1.3.0 Patched in 1.3.1
16. Patched High · 7.2 Contact Form Entries <= 1.2.9 - CSV Injection ↗
    2022-10-21 CVE-2022-3604 Improper Neutralization of Formula Elements in a CSV File Affects <= 1.2.9 Patched in 1.3.0
17. Patched Medium · 6.1 Contact Form Entries <= 1.2.3 - Reflected Cross-Site Scripting ↗
    2021-11-14 CVE-2021-25079 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.3 Patched in 1.2.4
18. Patched Medium · 6.1 CRM Perks - Various Plugins (Various Versions) - Reflected Cross-Site Scripting ↗
    2021-08-26 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.1 Patched in 1.2.2
19. Patched Medium · 6.1 Contact Form Entries – Contact Form 7, WPforms and more <= 1.2.0 - Reflected Cross-Site Scripting ↗
    2021-08-24 Improper Neutralization of Input During Web Page Generation Affects <= 1.2.0 Patched in 1.2.1
20. Patched High · 7.2 Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting ↗
    2021-01-05 CVE-2021-25080 Improper Neutralization of Input During Web Page Generation Affects <= 1.1.6 Patched in 1.1.7

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-16 70K+ → 60K+ down after 67 days in tier
2. 2026-03-10 60K+ → 70K+ up after 25 days in tier
3. 2026-02-13 70K+ → 60K+ down after 667 days in tier
4. 2024-04-17 60K+ → 70K+ up after 334 days in tier
5. 2023-05-19 50K+ → 60K+ up after 216 days in tier
6. 2022-10-15 40K+ → 50K+ up after 211 days in tier
7. 2022-03-18 30K+ → 40K+ up after 168 days in tier
8. 2021-10-01 20K+ → 30K+ up after 224 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Database for Contact Form 7, WPforms, Elementor forms into a readme, a review or a deck. It updates itself.

Database for Contact Form 7, WPforms, Elementor forms: 60K+ active installs, 4.8★ (124 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/contact-form-entries