Contact Forms by Cimatti

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ artoskogman

   4.6y ago

   Very easy to use, fast and good support. Best what I have found.

   Read on wp.org ↗
2. ★★★★★ cessholden

   9.4y ago

   Been using this plugin for years as it is so easy to use and really flexible. Latest release has broken the plugin and now won’t display any forms. very disappointed.

   Read on wp.org ↗
3. ★★★★★ limearts

   10.0y ago

   This plugin is in use since almost two years. It’s a great form builder with a lot of customisation.

   Read on wp.org ↗
4. ★★★★★ TJ

   10.2y ago

   Does everything I needed, and then some. The only improvement I could really go for is the ability to use the timezone that is set in WordPress to record dates and times of submissions. I was able to edit the plugin for my needs, at least until the plugin receives an update. Excellent work otherwise and well worth the 5 star rating.

   Read on wp.org ↗
5. ★★★★★ achtl

   10.5y ago

   Really nice Form-Plugin! The option to create and customize messages and “thank you”-sites is great. Responsive and multilingual. I use this Plugin in this website: kletterurlaub-spanien.de

   Read on wp.org ↗
6. ★★★★★ jidam

   10.6y ago

   There are a lot of similar plugins if you need forms for your WordPress. This one is my favorite. It doesn’t bother you with ugly pre-installed layouts, but offers a lot of options to configure just the form you need. The customizable notifications leave no wish unfulfilled. Well thought out. Thank you for the good work!

   Read on wp.org ↗
7. ★★★★★ vrmmedia

   10.7y ago

   I have tried a few contact form plugins and this is my favorite. We use this for all of our forms on four websites. Drag and drop interface, data exportable as spreadsheets, html email notifications, unlimited fields, shortcodes—a pleasure to use. Customer support is very prompt and helpful as well. The best!

   Read on wp.org ↗
8. ★★★★★ csmithFCEdge

   11.2y ago

   This is the second time I’ve used this plugin and I’m still having the same issue of not receiving email submissions. One 2 different sites. Im sticking with Contact Form 7.

   Read on wp.org ↗

11 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.3 Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery ↗
   2025-06-02 CVE-2025-49069 Cross-Site Request Forgery (CSRF) Affects <= 1.9.8 Patched in 1.9.9
2. Medium · 5.3 WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download ↗
   2025-01-31 CVE-2024-12184 Missing Authorization Affects <= 1.9.4 Patched in 1.9.5
3. Medium · 4.3 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function ↗
   2024-11-26 CVE-2024-10521 Cross-Site Request Forgery (CSRF) Affects <= 1.9.2 Patched in 1.9.3
4. Medium · 4.4 Contact Forms by Cimatti <= 1.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2024-03-29 CVE-2024-30549 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.0 Patched in 1.9.1
5. High · 7.2 Contact Forms by Cimatti <= 1.7.0 - Unauthenticated Stored Cross-Site Scripting ↗
   2024-03-16 CVE-2024-29117 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.7.0 Patched in 1.8.0
6. Medium · 4.3 Contact Forms by Cimatti <= 1.6.0 - Cross-Site Request Forgery via accua_forms_list_page_table ↗
   2023-10-25 CVE-2023-47230 Cross-Site Request Forgery (CSRF) Affects <= 1.6.0 Patched in 1.6.1
7. Medium · 4.3 WordPress Contact Forms by Cimatti <= 1.5.7 - Missing Authorization ↗
   2023-06-13 CVE-2023-35051 Missing Authorization Affects <= 1.5.7 Patched in 1.5.8
8. Medium · 4.3 WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action ↗
   2023-06-12 CVE-2023-2563 Cross-Site Request Forgery (CSRF) Affects <= 1.5.7 Patched in 1.5.8
9. High · 7.2 WordPress Contact Forms by Cimatti <= 1.5.4 - Unauthenticated Stored Cross-Site Scripting ↗
   2023-03-27 CVE-2023-28781 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.4 Patched in 1.5.5
10. Medium · 6.1 Contact Forms by Cimatti <= 1.5.4 - Reflected Cross-Site Scripting via 'form-field-id', 'edit-fid', 'id', 'name', 'type', 'description' Parameters ↗
    2023-03-27 CVE-2023-28789 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.5.4 Patched in 1.5.5
11. Medium · 5.5 Cimatti Contact Forms <= 1.4.11 - Cross-Site Scripting ↗
    2021-09-27 CVE-2021-24744 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.4.12 Patched in 1.4.12

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-22 700+ → 600+ down after 1 days in tier
2. 2026-06-21 600+ → 700+ up after 1 days in tier
3. 2026-06-20 700+ → 600+ down after 3 days in tier
4. 2026-06-17 600+ → 700+ up after 5 days in tier
5. 2026-06-12 700+ → 600+ down after 155 days in tier
6. 2026-01-08 800+ → 700+ down after 1 days in tier
7. 2026-01-07 700+ → 800+ up after 3 days in tier
8. 2026-01-04 800+ → 700+ down after 9 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Lead Form Builder & Contact Form 8K+ installs · 4.0★ · 3 shared tags B
• Lead Generation Form 600+ installs · 3.6★ · 3 shared tags B
• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 2 shared tags A
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 2 shared tags A
• Ninja Forms – The Contact Form Builder That Grows With You 600K+ installs · 4.4★ · 2 shared tags A
• SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz 500K+ installs · 4.7★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for Contact Forms by Cimatti into a readme, a review or a deck. It updates itself.

Contact Forms by Cimatti: 600+ active installs, 4.4★ (16 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/contact-forms