Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Reviewers keep praising the plugin's ease of use, fast support replies, and form-building features, with only a couple asking for template reuse and integration copying options.

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

2877 searches this plugin appeared in over the last 90 days, 20 listed. 2544 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 67% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 16 days ago and a band this size takes about a year or more to cross, so the real count is still just over 800K.

At the current install trend, crossing 900K+ in roughly 339 days.

1. ★★★★★ John Stringfellow

   3mo ago

   This form plugin works beautifully and the developers do NOT drive you crazy with prompts to upgrade at every turn. It is simple, nicely designed and helps me get my work done faster.

   Read on wp.org ↗
2. ★★★★★ CesarJR

   4mo ago

   Desde hace tiempo ya he estado trabajando con este plugin para formularios y la verdad es que es uno de los mejores, tiene funcionalidades excelentes y es sencillo de configurar/usar. Lo recomiendo ampliamente.

   Read on wp.org ↗
3. ★★★★★ corgabriels

   4mo ago

   Asked a question on usage of a standard block field and within minutes after entering the ticket I already received the reply, with an answer that resolved my problem. Very good support !

   Read on wp.org ↗
4. ★★★★★ Daniel Figueiredo

   4mo ago

   O Plugin atende todas as necessidades de criação de um formulário desde os mas simples aos mais complexos e completos. Pode-se dizer que pensaram em todos os cenários possíveis para a criação de formulários que atendam todas as necessidades. Muito bom!

   Read on wp.org ↗
5. ★★★★★ andrewhalf

   4mo ago

   I used gravity forms for a long time before switching to fluent forms, and I don’t regret it.GF’s cloud upload options were limited to dropbox, which got expensive for what I needed. Fluent forms cloud storage addon gives me both dropbox and cloudflare R2, so I can pick what works best per project! r2 alone has saved me real money.Also, conditional folder option has also been a pleasant surprise. My uploads now sort into the right folders nicely which is saving time and even cutting hosting costs. Fluent forms keeps improving with every update. A few small things could still be better, but overall I’m glad I switched and don’t plan on going back.

   Read on wp.org ↗
6. ★★★★★ Lennonka

   4mo ago

   Fantastic plugin for building custom forms. Great support too.

   Read on wp.org ↗
7. ★★★★★ totorpedro

   4mo ago

   Très bon plugin de formulaire, le support technique est excellent, très rapide et efficace.

   Read on wp.org ↗
8. ★★★★★ bigbankclub

   4mo ago

   Time spent on using this plugin is limited, as it walks you through the needed process. Beats out WPforms and OMG old Contact Form 7 and no need to cry about how to set it up. Tested the free, went to paid & well – impressed, many integrations, and yes the support is there. They’re a solid group of people – looking to create solutions. Good plugin – best I have used yet.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 6.2.8 Fixes a stored XSS vulnerability in form submission handling 6.2.8
2. — Version 6.2.7 Fixes date field restrictions configurations Improves Advanced Date Configuration to support more restriction patterns: comparison operators, combined conditions, month/day/year rules, and fixed calendar dates Improve St 6.2.7
3. — Version 6.2.6 Improves the Other option in conversational forms to be keyboard-activatable Fixes a manager privilege escalation via a delegated WordPress role Fixes a payment permission bypass letting form managers update transactions 6.2.6
4. — Version 6.2.5 Improved the authorization scope for entry deletion so bulk and single deletes stay within the authorized request Adds missing integrations to the addons list and global search Fixes a conditional logic for empty fields 6.2.5
5. — Version 6.2.4 Fixes conversational form pretty URLs rendering Fixes Pretty URL toggle not persisting when disabled Fixes multi-step form submit visibility and step-skip logic Adds a notice when the Fluent Forms REST endpoints are unre 6.2.4
6. — Version 6.2.3 Adds option group support for Dropdown and Multi-select fields Adds pinned column support in the entries table Adds new icon presets, SVG icon support, and active/inactive color options for the Ratings field Adds search 6.2.3

All 46 disclosed vulnerabilities are patched in the current version (6.2.16). Sites still on an older version should update.

1. Patched Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.15 - Missing Authorization ↗
   2026-10-19 CVE-2026-111831 Missing Authorization Affects <= 6.2.15 Patched in 6.2.16
2. Patched Medium · 5.4 Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification ↗
   2026-10-09 CVE-2026-15178 Missing Authorization Affects <= 6.2.5 Patched in 6.2.6
3. Patched Medium · 4.7 Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter ↗
   2026-10-09 CVE-2026-101324 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.14 Patched in 6.2.15
4. Patched Medium · 6.4 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-10-01 CVE-2026-103343 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.14 Patched in 6.2.15
5. Patched Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization ↗
   2026-10-01 CVE-2026-103353 Missing Authorization Affects <= 6.2.14 Patched in 6.2.15
6. Patched High · 7.2 Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values ↗
   2026-08-12 CVE-2026-18146 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.11 Patched in 6.2.12
7. Patched Medium · 4.3 Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion ↗
   2026-08-11 CVE-2026-11578 Authorization Bypass Through User-Controlled Key Affects <= 6.2.4 Patched in 6.2.5
8. Patched Medium · 4.3 Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation ↗
   2026-08-10 CVE-2026-11880 Authorization Bypass Through User-Controlled Key Affects <= 6.2.0 Patched in 6.2.1
9. Patched Medium · 6.1 Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param' ↗
   2026-07-31 CVE-2026-17571 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.8 Patched in 6.2.9
10. Patched Medium · 5.3 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter ↗
    2026-07-30 CVE-2026-17567 Authorization Bypass Through User-Controlled Key Affects <= 6.2.8 Patched in 6.2.9
11. Patched Medium · 6.4 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2026-07-30 CVE-2026-11881 Improper Neutralization of Input During Web Page Generation Affects < 6.2.6 Patched in 6.2.6
12. Patched High · 7.2 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member ↗
    2026-07-28 CVE-2026-16655 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.7 Patched in 6.2.8
13. Patched Medium · 5.4 Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' ↗
    2026-07-09 CVE-2026-5069 Incorrect Authorization Affects <= 6.2.1 Patched in 6.2.2
14. Patched High · 8.2 Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter ↗
    2026-05-13 CVE-2026-5395 Authorization Bypass Through User-Controlled Key Affects <= 6.2.0 Patched in 6.2.1
15. Patched High · 8.2 Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter ↗
    2026-05-13 CVE-2026-5396 Authorization Bypass Through User-Controlled Key Affects <= 6.1.21 Patched in 6.2.0
16. Patched Medium · 6.4 Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute ↗
    2026-05-12 CVE-2026-6828 Improper Neutralization of Input During Web Page Generation Affects <= 6.2.1 Patched in 6.2.2
17. Patched Medium · 4.9 Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment ↗
    2026-05-05 CVE-2026-6344 Improper Limitation of a Pathname to a Restricted Directory Affects <= 6.2.1 Patched in 6.2.2
18. Patched Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification ↗
    2026-04-16 CVE-2026-4160 Authorization Bypass Through User-Controlled Key Affects 6.1.21 Patched in 6.2.0
19. Patched Medium · 6.4 Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module ↗
    2026-02-09 CVE-2026-0996 Improper Neutralization of Input During Web Page Generation Affects <= 6.1.14 Patched in 6.1.15
20. Patched Medium · 4.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.14 - Missing Authorization ↗
    2026-01-25 CVE-2026-25313 Missing Authorization Affects <= 6.1.14 Patched in 6.1.15
21. Patched Medium · 6.5 FluentForm <= 6.1.11 - Unauthenticated Arbitrary Shortcode Execution ↗
    2026-01-13 CVE-2025-69001 Improper Control of Generation of Code Affects <= 6.1.11 Patched in 6.1.12
22. Patched Medium · 5.3 Fluent Forms <= 6.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder ↗
    2026-01-06 CVE-2025-13722 Missing Authorization Affects <= 6.1.7 Patched in 6.1.8
23. Patched Medium · 5.3 Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id ↗
    2025-12-05 CVE-2025-13748 Authorization Bypass Through User-Controlled Key Affects <= 6.1.7 Patched in 6.1.8
24. Patched Medium · 6.5 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read ↗
    2025-09-02 CVE-2025-9260 Deserialization of Untrusted Data Affects 5.1.16 - 6.1.1 Patched in 6.1.2
25. Patched Medium · 6.4 Fluent Forms <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2025-04-16 CVE-2025-3615 Improper Neutralization of Input During Web Page Generation Affects <= 6.0.2 Patched in 6.0.3
26. Patched Medium · 5.3 Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing ↗
    2025-03-21 CVE-2024-13666 Improper Input Validation Affects <= 5.2.12 Patched in 6.0.0
27. Patched High · 7.2 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting via Form Subject ↗
    2024-12-13 CVE-2024-10646 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.6 Patched in 5.2.7
28. Patched Medium · 4.4 Fluent Forms <= 5.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-11-18 CVE-2024-9651 Improper Neutralization of Input During Web Page Generation Affects <= 5.2.0 Patched in 5.2.1
29. Patched Medium · 4.9 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting ↗
    2024-10-04 CVE-2024-9528 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.19 Patched in 5.1.20
30. Patched Medium · 4.2 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification ↗
    2024-08-31 CVE-2024-5053 Improper Authorization Affects <= 5.1.18 Patched in 5.1.19
31. Patched Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6520 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.19 Patched in 5.1.20
32. Patched Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6518 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.19 Patched in 5.1.20
33. Patched Medium · 4.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-07-26 CVE-2024-6521 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.19 Patched in 5.1.20
34. Patched Medium · 4.9 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.19 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields ↗
    2024-07-26 CVE-2024-6703 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.19 Patched in 5.1.20
35. Patched High · 7.5 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues ↗
    2024-05-21 CVE-2024-4157 Deserialization of Untrusted Data Affects <= 5.1.15 Patched in 5.1.16
36. Patched Medium · 6.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting ↗
    2024-05-17 CVE-2024-2772 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.13 Patched in 5.1.14
37. Patched High · 7.5 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation ↗
    2024-05-17 CVE-2024-2782 Missing Authorization Affects <= 5.1.16 Patched in 5.1.17
38. Patched Critical · 9.8 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation ↗
    2024-05-17 CVE-2024-2771 Missing Authorization Affects <= 5.1.16 Patched in 5.1.17
39. Patched Medium · 6.4 Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-05-17 CVE-2024-4709 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.16 Patched in 5.1.17
40. Patched Medium · 4.9 Fluent Forms <= 5.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
    2024-03-05 CVE-2023-6957 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.9 Patched in 5.1.10
41. Patched Medium · 4.4 Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title ↗
    2024-01-18 CVE-2024-0618 Improper Neutralization of Input During Web Page Generation Affects <= 5.1.5 Patched in 5.1.7
42. Patched Medium · 5.3 Contact Form for Plugin by Fluent Forms <= 5.0.8 - Insecure Direct Object Reference ↗
    2023-09-08 CVE-2023-41952 Authorization Bypass Through User-Controlled Key Affects < 5.0.9 Patched in 5.0.9
43. Patched High · 7.2 FluentForm <= 4.3.25 - Authenticated (Administrator+) SQL Injection ↗
    2023-07-12 CVE-2023-24410 Improper Neutralization of Special Elements used in an SQL Command Affects <= 4.3.25 Patched in 5.0.0
44. Patched Medium · 6.4 FluentForms <= 4.3.24 - Authenticated(Contributor+) Stored Cross-Site Scripting ↗
    2023-03-20 CVE-2023-0546 Improper Neutralization of Input During Web Page Generation Affects <= 4.3.24 Patched in 4.3.25
45. Patched High · 8.3 Contact Form Plugin by FluentForm <= 4.3.12 - CSV Injection ↗
    2022-10-17 CVE-2022-3463 Improper Neutralization of Formula Elements in a CSV File Affects <= 4.3.12 Patched in 4.3.13
46. Patched High · 8.8 WP Fluent Forms < 3.6.67 - Stored Cross-Site Scripting ↗
    2021-06-16 CVE-2021-34620 Improper Neutralization of Input During Web Page Generation Affects < 3.6.67 Patched in 3.6.67

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 32 languages, 13 at 90% or more

Plus 8 more locales with partial translations.

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-10-15 700K+ → 800K+ up after 7 days in tier
2. 2026-10-08 800K+ → 700K+ down after 1 days in tier
3. 2026-10-07 700K+ → 800K+ up after 202 days in tier
4. 2026-03-19 600K+ → 700K+ up after 233 days in tier
5. 2025-07-29 500K+ → 600K+ up after 3 days in tier
6. 2025-07-26 600K+ → 500K+ down after 10 days in tier
7. 2025-07-16 500K+ → 600K+ up after 292 days in tier
8. 2024-09-27 400K+ → 500K+ up after 285 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder into a readme, a review or a deck. It updates itself.

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder: 800K+ active installs, 4.8★ (807 reviews). Plugin Pulse (WP Mayor), as of 2026-10-31. https://plugins.wpmayor.com/plugin/fluentform