FormCraft – Form Builder

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

Share of active installs on each version of this plugin · 93% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A small install base leaves thin data to model from.

1. ★★★★★ thzorro

   10mo ago

   The plugin suddenly stopped working, and there has been no response from support—neither directly nor through Envato. Even after renewing the service and update plan, I still received no help or communication at all. Very disappointing experience.

   Read on wp.org ↗
2. ★★★★★ plexsites

   1.8y ago

   Without any indication my 2 forms were deleted, I recreate the form after noticing and now the Shortcode does not show the Form. There are many better free alternatives

   Read on wp.org ↗
3. ★★★★★ brent121

   2.1y ago

   It’s a good and easy to use plugin for forms. In its free version it also has the option of the entries shown in WordPress dashboard. If you get it premium, you can also make surveys, get more nice looking templates and more add-ons like Stripe, email providers integrations and it also has SMTP feature. I don’t like that the new add-ons come with a new plugin though…

   Read on wp.org ↗
4. ★★★★★ Henry Nagel

   2.6y ago

   I like the conditional logic creator, easy to use

   Read on wp.org ↗
5. ★★★★★ fullermetric

   3.8y ago

   Seeing many attempts at accessing our site from varying i/p addresses by way of this plugin which we do not have installed. 3:22 pm plugins/formcraft/file-upload/server/content/upload.php WP-CERBER is doing it’s job, but I’ve seen 3 different i/p address try and access this file. Is your plugin a backend for site attacks?

   Read on wp.org ↗
6. ★★★★★ gerlofdelange

   4.0y ago

   A lot of features in the free version. Great!

   Read on wp.org ↗
7. ★★★★★ Elliot

   4.4y ago

   Why you are not updating the plugin more frequently? You know that rings some bells and prevents you from gaining more users. Other than that, this is an awesome plugin.

   Read on wp.org ↗
8. ★★★★★ Toublanc

   4.9y ago

   I like! It’s doing my job.

   Read on wp.org ↗

10 disclosed vulnerabilities on record for this plugin, 2 still affect the current version.

1. Medium · 4.3 FormCraft <= 1.2.10 - Missing Authorization ↗
   2024-08-07 CVE-2024-43157 Missing Authorization Affects <= 1.2.10 Patched in 1.2.11
2. Medium · 5.3 FormCraft <= 1.2.7 - Missing Authorization via formcraft_nag_update ↗
   2023-11-16 CVE-2023-47823 Missing Authorization Affects <= 1.2.7 Patched in 1.2.8
3. Medium · 4.4 FormCraft <= 1.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2023-08-02 CVE-2023-3501 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.6 Patched in 1.2.7
4. Medium · 6.6 FormCraft Premium <= 3.9.6 - Authenticated(Administrator+) SQL Injection ↗
   2023-06-05 CVE-2023-2592 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects <= 3.9.5 Patched in 3.9.6
5. Medium · 6.4 FormCraft <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via fcb shortcode ↗
   2023-04-19 CVE-2023-22717 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.2.9 Patched in 1.2.10
6. Medium · 5.5 FormCraft Basic <= 1.2.5 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
   2022-05-16 CVE-2022-1647 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.2.6 Patched in 1.2.6
7. Critical · 9.1 Formcraft3 <= 3.8.27 - Server Side Request Forgery ↗
   2022-02-28 CVE-2022-0591 Server-Side Request Forgery (SSRF) Affects < 3.8.28 Patched in 3.8.28
8. High · 8.8 FormCraft <= 1.2.1 - Cross-Site Request Forgery ↗
   2019-02-26 CVE-2019-5920 Cross-Site Request Forgery (CSRF) Affects <= 1.2.1 Patched in 1.2.2
9. High · 8.8 FormCraft <= 1.2.1 - Cross-Site Request Forgery ↗
   2019-02-26 CVE-2019-15114 Cross-Site Request Forgery (CSRF) Affects < 1.2.2 Patched in 1.2.2
10. Critical · 9.8 FormCraft Basic 1.0.5 - SQL Injection via id Parameter ↗
    2017-07-05 CVE-2017-13137 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Affects 1.0.5 Patched in 1.0.6

Automated install-time checks, tested on PHP 8.1.12 · WP 6.6.1

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-05-19 3K+ → 2K+ down after 1 days in tier
2. 2026-05-18 2K+ → 3K+ up after 1 days in tier
3. 2026-05-17 3K+ → 2K+ down after 533 days in tier
4. 2024-11-30 4K+ → 3K+ down after 470 days in tier
5. 2023-08-18 5K+ → 4K+ down

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor 600K+ installs · 4.7★ · 2 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 2 shared tags A
• Ultra Addons for Contact Form 7 60K+ installs · 4.7★ · 2 shared tags A
• Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder 30K+ installs · 4.5★ · 2 shared tags A
• R reCaptcha Add-On for FormCraft 7K+ installs · 4.0★ · 2 shared tags D
• Survey Maker by AYS 5K+ installs · 4.7★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for FormCraft – Form Builder into a readme, a review or a deck. It updates itself.

FormCraft – Form Builder: 2K+ active installs, 4.5★ (53 reviews). Plugin Pulse (WP Mayor), as of 2026-08-29. https://plugins.wpmayor.com/plugin/formcraft-form-builder