Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 67% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

At the current install trend, crossing 800K+ in roughly 293 days.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price.

Reviewers keep praising the plugin's ease of use, fast support replies, and form-building features, with only a couple asking for template reuse and integration copying options.

1. ★★★★★ John Stringfellow

   1mo ago

   This form plugin works beautifully and the developers do NOT drive you crazy with prompts to upgrade at every turn. It is simple, nicely designed and helps me get my work done faster.

   Read on wp.org ↗
2. ★★★★★ CesarJR

   1mo ago

   Desde hace tiempo ya he estado trabajando con este plugin para formularios y la verdad es que es uno de los mejores, tiene funcionalidades excelentes y es sencillo de configurar/usar. Lo recomiendo ampliamente.

   Read on wp.org ↗
3. ★★★★★ corgabriels

   1mo ago

   Asked a question on usage of a standard block field and within minutes after entering the ticket I already received the reply, with an answer that resolved my problem. Very good support !

   Read on wp.org ↗
4. ★★★★★ Daniel Figueiredo

   2mo ago

   O Plugin atende todas as necessidades de criação de um formulário desde os mas simples aos mais complexos e completos. Pode-se dizer que pensaram em todos os cenários possíveis para a criação de formulários que atendam todas as necessidades. Muito bom!

   Read on wp.org ↗
5. ★★★★★ andrewhalf

   2mo ago

   I used gravity forms for a long time before switching to fluent forms, and I don’t regret it.GF’s cloud upload options were limited to dropbox, which got expensive for what I needed. Fluent forms cloud storage addon gives me both dropbox and cloudflare R2, so I can pick what works best per project! r2 alone has saved me real money.Also, conditional folder option has also been a pleasant surprise. My uploads now sort into the right folders nicely which is saving time and even cutting hosting costs. Fluent forms keeps improving with every update. A few small things could still be better, but overall I’m glad I switched and don’t plan on going back.

   Read on wp.org ↗
6. ★★★★★ Lennonka

   2mo ago

   Fantastic plugin for building custom forms. Great support too.

   Read on wp.org ↗
7. ★★★★★ totorpedro

   2mo ago

   Très bon plugin de formulaire, le support technique est excellent, très rapide et efficace.

   Read on wp.org ↗
8. ★★★★★ bigbankclub

   2mo ago

   Time spent on using this plugin is limited, as it walks you through the needed process. Beats out WPforms and OMG old Contact Form 7 and no need to cry about how to set it up. Tested the free, went to paid & well – impressed, many integrations, and yes the support is there. They’re a solid group of people – looking to create solutions. Good plugin – best I have used yet.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.2.8 Fixes a stored XSS vulnerability in form submission handling 6.2.8
2. — Version 6.2.7 Fixes date field restrictions configurations Improves Advanced Date Configuration to support more restriction patterns: comparison operators, combined conditions, month/day/year rules, and fixed calendar dates Improve St 6.2.7
3. — Version 6.2.6 Improves the Other option in conversational forms to be keyboard-activatable Fixes a manager privilege escalation via a delegated WordPress role Fixes a payment permission bypass letting form managers update transactions 6.2.6
4. — Version 6.2.5 Improved the authorization scope for entry deletion so bulk and single deletes stay within the authorized request Adds missing integrations to the addons list and global search Fixes a conditional logic for empty fields 6.2.5
5. — Version 6.2.4 Fixes conversational form pretty URLs rendering Fixes Pretty URL toggle not persisting when disabled Fixes multi-step form submit visibility and step-skip logic Adds a notice when the Fluent Forms REST endpoints are unre 6.2.4
6. — Version 6.2.3 Adds option group support for Dropdown and Multi-select fields Adds pinned column support in the entries table Adds new icon presets, SVG icon support, and active/inactive color options for the Ratings field Adds search 6.2.3

41 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. High · 7.2 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values ↗
   2026-08-12 CVE-2026-18146 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.2.11 Patched in 6.2.12
2. Medium · 4.3 Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion ↗
   2026-08-11 CVE-2026-11578 Authorization Bypass Through User-Controlled Key Affects <= 6.2.4 Patched in 6.2.5
3. Medium · 4.3 Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation ↗
   2026-08-10 CVE-2026-11880 Authorization Bypass Through User-Controlled Key Affects <= 6.2.0 Patched in 6.2.1
4. Medium · 6.1 Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' ↗
   2026-07-31 CVE-2026-17571 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.2.8 Patched in 6.2.9
5. Medium · 5.3 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter ↗
   2026-07-30 CVE-2026-17567 Authorization Bypass Through User-Controlled Key Affects <= 6.2.8 Patched in 6.2.9
6. Medium · 6.4 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-07-30 CVE-2026-11881 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 6.2.6 Patched in 6.2.6
7. High · 7.2 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member ↗
   2026-07-28 CVE-2026-16655 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.2.7 Patched in 6.2.8
8. Medium · 5.4 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' ↗
   2026-07-09 CVE-2026-5069 Incorrect Authorization Affects <= 6.2.1 Patched in 6.2.2
9. High · 8.2 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter ↗
   2026-05-13 CVE-2026-5395 Authorization Bypass Through User-Controlled Key Affects <= 6.2.0 Patched in 6.2.1
10. High · 8.2 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter ↗
    2026-05-13 CVE-2026-5396 Authorization Bypass Through User-Controlled Key Affects <= 6.1.21 Patched in 6.2.0
11. Medium · 6.4 Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute ↗
    2026-05-12 CVE-2026-6828 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.2.1 Patched in 6.2.2
12. Medium · 4.9 Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment ↗
    2026-05-05 CVE-2026-6344 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 6.2.1 Patched in 6.2.2
13. Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification ↗
    2026-04-16 CVE-2026-4160 Authorization Bypass Through User-Controlled Key Affects 6.1.21 Patched in 6.2.0
14. Medium · 6.4 Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module ↗
    2026-02-09 CVE-2026-0996 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.1.14 Patched in 6.1.15
15. Medium · 4.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization ↗
    2026-01-25 CVE-2026-25313 Missing Authorization Affects <= 6.1.14 Patched in 6.1.15
16. Medium · 6.5 FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-01-13 CVE-2025-69001 Improper Control of Generation of Code ('Code Injection') Affects <= 6.1.11 Patched in 6.1.12
17. Medium · 5.3 Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder ↗
    2026-01-06 CVE-2025-13722 Missing Authorization Affects <= 6.1.7 Patched in 6.1.8
18. Medium · 5.3 Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id ↗
    2025-12-05 CVE-2025-13748 Authorization Bypass Through User-Controlled Key Affects <= 6.1.7 Patched in 6.1.8
19. Medium · 6.5 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read ↗
    2025-09-02 CVE-2025-9260 Deserialization of Untrusted Data Affects 5.1.16 - 6.1.1 Patched in 6.1.2
20. Medium · 6.4 Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-04-16 CVE-2025-3615 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 6.0.2 Patched in 6.0.3
21. Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing ↗
    2025-03-21 CVE-2024-13666 Improper Input Validation Affects <= 5.2.12 Patched in 6.0.0
22. High · 7.2 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject ↗
    2024-12-13 CVE-2024-10646 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.6 Patched in 5.2.7
23. Medium · 4.4 Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-11-18 CVE-2024-9651 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.2.0 Patched in 5.2.1
24. Medium · 4.9 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting ↗
    2024-10-04 CVE-2024-9528 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.19 Patched in 5.1.20
25. Medium · 4.2 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification ↗
    2024-08-31 CVE-2024-5053 Improper Authorization Affects <= 5.1.18 Patched in 5.1.19
26. Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6520 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.19 Patched in 5.1.20
27. Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6518 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.19 Patched in 5.1.20
28. Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6521 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.19 Patched in 5.1.20
29. Medium · 4.9 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields ↗
    2024-07-26 CVE-2024-6703 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.19 Patched in 5.1.20
30. High · 7.5 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues ↗
    2024-05-21 CVE-2024-4157 Deserialization of Untrusted Data Affects <= 5.1.15 Patched in 5.1.16
31. Medium · 6.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-05-17 CVE-2024-2772 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.13 Patched in 5.1.14
32. High · 7.5 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation ↗
    2024-05-17 CVE-2024-2782 Missing Authorization Affects <= 5.1.16 Patched in 5.1.17
33. Critical · 9.8 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation ↗
    2024-05-17 CVE-2024-2771 Missing Authorization Affects <= 5.1.16 Patched in 5.1.17
34. Medium · 6.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-05-17 CVE-2024-4709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.16 Patched in 5.1.17
35. Medium · 4.9 Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-05 CVE-2023-6957 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.9 Patched in 5.1.10
36. Medium · 4.4 Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title ↗
    2024-01-18 CVE-2024-0618 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 5.1.5 Patched in 5.1.7
37. Medium · 5.3 Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference ↗
    2023-09-08 CVE-2023-41952 Authorization Bypass Through User-Controlled Key Affects < 5.0.9 Patched in 5.0.9
38. High · 7.2 FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection ↗
    2023-07-12 CVE-2023-24410 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 4.3.25 Patched in 5.0.0
39. Medium · 6.4 FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting ↗
    2023-03-20 CVE-2023-0546 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.3.24 Patched in 4.3.25
40. High · 8.3 Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection ↗
    2022-10-17 CVE-2022-3463 Improper Neutralization of Formula Elements in a CSV File Affects <= 4.3.12 Patched in 4.3.13
41. High · 8.8 WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting ↗
    2021-06-16 CVE-2021-34620 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 3.6.67 Patched in 3.6.67

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 29 languages, 14 at 90% or more

Plus 5 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-03-19 600K+ → 700K+ up after 233 days in tier
2. 2025-07-29 500K+ → 600K+ up after 3 days in tier
3. 2025-07-26 600K+ → 500K+ down after 10 days in tier
4. 2025-07-16 500K+ → 600K+ up after 292 days in tier
5. 2024-09-27 400K+ → 500K+ up after 285 days in tier
6. 2023-12-17 300K+ → 400K+ up after 301 days in tier
7. 2023-02-19 200K+ → 300K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 4 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 4 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 4 shared tags A
• Ultra Addons for Contact Form 7 60K+ installs · 4.7★ · 4 shared tags A
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder 20K+ installs · 4.2★ · 4 shared tags A
• Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms 20K+ installs · 4.4★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder into a readme, a review or a deck. It updates itself.

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: 700K+ active installs, 4.8★ (788 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/fluentform