MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

No paid tier is visible, so we don't put a figure on revenue or sale value: that would be guessing. The install base is a real asset to an acquirer, just not one public data lets us price. A declining trend compresses what a buyer would pay.

Reviewers are mostly happy with ease of use and responsive support, though one recent review flagged bot-only replies and conflicts with static or heavily cached sites.

1. ★★★★★ Masoom Nazir Sanadi

   1mo ago

   nice

   Read on wp.org ↗
2. ★★★★★ gillgner

   2mo ago

   Dinâmico, eficiente e eficaz. Um dos melhores já disponibilizados pela plataforma.

   Read on wp.org ↗
3. ★★★★★ umtasnim

   2mo ago

   Works fine, easy to use and configure

   Read on wp.org ↗
4. ★★★★★ Gareth Bult

   3mo ago

   First off I’ve tried to explore this issue with the support process, all I seem to get in response it a bot. It looks like the plugin does not play well with static sites or heavily cached sites.

   Read on wp.org ↗
5. ★★★★★ webdevgo

   3mo ago

   I like this form builder because it’s easy to use and built into the one of only two page builders that I find useful for my work as a web designer. It looks really good as well and it’s seamless to integrate into just about any theme/template you happen to want to use. Also, when it comes time for me to pay for the form there are so many options allowing you to pay for it however you feel comfortable to do so. Good job MetForm!

   Read on wp.org ↗
6. ★★★★★ annscraft

   3mo ago

   Never face any issue after successfully integrate.

   Read on wp.org ↗
7. ★★★★★ lexstyleim

   4mo ago

   I have been using MetForm for the past 6 years, since version 1 and I have seen this plugin evolve. I have used it in several websites and it has always been a great help to create forms faster. I recently detected an issue related to payments and notifications, and Ikbal from the developers’ team reached back and fixed it promptly. All I can say is that it has been a great experience using the plugin and a great experience talking with Ikbal and the developers’ team, they are always listening to new requests and trying to help you. I had a request and they developed it very fast, which nowadays is rare. Great product and great team behind the scenes. 100% recommended!

   Read on wp.org ↗
8. ★★★★★ robdev8

   4mo ago

   It really helped in creating a secure contact form.

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2025-04-15 Version 3.9.8 Version: 3.9.7 // 2025-03-25 Improved: Form creation process. Fixed: Form settings notification issue on the admin area. Fixed: Onboarding UI issue. Version: 3.9.6 // 2025-03-10 Added: Compatibility with Elementor plugin 3.9.8
2. 2025-02-24 Version 3.9.5 Version: 3.9.4 // 2025-02-18 Fixed: Compatibility issue with Elementor. Fixed: XSS security issue. Version: 3.9.3 // 2025-01-20 Improved: MailChimp integration security. Fixed: Email notification issue with selection typ 3.9.5

27 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 6.4 MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting ↗
   2026-08-24 CVE-2026-18100 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.1.8 Patched in 4.1.9
2. Low · 3.7 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value ↗
   2026-01-23 CVE-2026-0633 Improper Authentication Affects <= 4.1.0 Patched in 4.1.1
3. Medium · 6.4 MetForm <= 4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via `mf-template` DOM Element ↗
   2025-07-29 CVE-2025-5684 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 4.0.1 Patched in 4.0.2
4. Medium · 5.5 Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery ↗
   2025-03-27 CVE-2025-30914 Server-Side Request Forgery (SSRF) Affects <= 3.9.2 Patched in 3.9.3
5. High · 8.1 Metform Elementor Contact Form Builder <= 3.2.4 - Unauthenticated Double-Extension Arbitrary File Upload ↗
   2024-08-16 CVE-2023-0714 Unrestricted Upload of File with Dangerous Type Affects <= 3.2.4 Patched in 3.3.0
6. Medium · 5.3 MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure ↗
   2024-06-10 CVE-2024-4266 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 3.8.8 Patched in 3.8.9
7. Medium · 4.3 Metform Elementor Contact Form Builder <= 3.8.3 - Missing Authorization to Notice Dismissal ↗
   2024-04-25 CVE-2024-33570 Missing Authorization Affects <= 3.8.3 Patched in 3.8.4
8. Medium · 6.4 Metform Elementor Contact Form Builder <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ↗
   2024-04-01 CVE-2024-2791 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.5 Patched in 3.8.6
9. Medium · 6.4 Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ↗
   2024-03-07 CVE-2024-1585 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.8.3 Patched in 3.8.4
10. Medium · 5.4 Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgery ↗
    2024-01-08 CVE-2023-6788 Cross-Site Request Forgery (CSRF) Affects <= 3.8.1 Patched in 3.8.2
11. Medium · 5.3 Metform Elementor Contact Form Builder <= 3.4.0 - Missing Authorization via submit ↗
    2023-12-26 CVE-2023-50903 Missing Authorization Affects <= 3.4.0 Patched in 3.4.1
12. Medium · 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode ↗
    2023-08-30 CVE-2023-0689 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
13. Medium · 5.4 Metform Elementor Contact Form Builder <= 3.3.2 - Cross-Site Request Forgery via permalink_setup ↗
    2023-06-22 CVE-2023-2517 Cross-Site Request Forgery (CSRF) Affects <= 3.3.2 Patched in 3.3.3
14. Medium · 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf shortcode ↗
    2023-06-08 CVE-2023-0694 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
15. Medium · 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf shortcode ↗
    2023-06-08 CVE-2023-0695 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.0 Patched in 3.3.1
16. Medium · 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_transaction_id' shortcode ↗
    2023-06-08 CVE-2023-0693 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
17. Medium · 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_last_name shortcode ↗
    2023-06-08 CVE-2023-0709 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.0 Patched in 3.3.1
18. Medium · 6.5 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_thankyou shortcode ↗
    2023-06-08 CVE-2023-0688 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
19. Medium · 4.9 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_thankyou shortcode ↗
    2023-06-08 CVE-2023-0710 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.0 Patched in 3.3.1
20. Medium · 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via mf_last_name shortcode ↗
    2023-06-08 CVE-2023-0691 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
21. Medium · 5.4 Metform Elementor Contact Form Builder <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mf_first_name shortcode ↗
    2023-06-08 CVE-2023-0708 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.3.0 Patched in 3.3.1
22. High · 8.3 Metform Elementor Contact Form Builder <= 3.3.0 - Unauthenticated CSV Injection ↗
    2023-06-08 CVE-2023-0721 Improper Neutralization of Formula Elements in a CSV File Affects <= 3.3.0 Patched in 3.3.1
23. Medium · 4.3 Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_payment_status' shortcode ↗
    2023-06-08 CVE-2023-0692 Authorization Bypass Through User-Controlled Key Affects <= 3.3.1 Patched in 3.3.2
24. Medium · 6.5 Metform Elementor Contact Form Builder <= 3.3.0 - Missing Authorization ↗
    2023-05-04 CVE-2023-1843 Missing Authorization Affects <= 3.3.0 Patched in 3.3.2
25. Medium · 5.3 Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass ↗
    2023-03-02 CVE-2023-0085 Protection Mechanism Failure Affects <= 3.2.1 Patched in 3.2.2
26. High · 7.2 Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting ↗
    2023-02-02 CVE-2023-0084 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 3.1.2 Patched in 3.2.0
27. High · 7.5 Metform Elementor Contact Form Builder <= 2.1.3 - Sensitive Information Disclosure ↗
    2022-04-23 CVE-2022-1442 Missing Authorization Affects <= 2.1.3 Patched in 2.1.4

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 15 languages, 5 at 90% or more

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2025-10-15 500K+ → 600K+ up after 230 days in tier
2. 2025-02-27 400K+ → 500K+ up after 219 days in tier
3. 2024-07-23 300K+ → 400K+ up after 227 days in tier
4. 2023-12-09 200K+ → 300K+ up after 278 days in tier
5. 2023-03-06 100K+ → 200K+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• RTMForm Builder 30K+ installs · 4.1★ · 3 shared tags B
• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More 5M+ installs · 4.8★ · 2 shared tags A
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 2 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 2 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 2 shared tags A
• Ultra Addons for Contact Form 7 60K+ installs · 4.7★ · 2 shared tags A

Embed this report card

Drop a live Pulse card for MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor into a readme, a review or a deck. It updates itself.

MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor: 600K+ active installs, 4.7★ (503 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/metform