WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 25% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Refined from the date this plugin crossed into its current band.

A large install base, a clear pro tier and a steady trend. As reliable as an outside estimate gets. The range spans more than 10x because wp.org publishes install counts as broad bands, and conversion and price compound on top. Read the midpoint as an order of magnitude, not a valuation.

Reviewers are largely happy with WPForms, praising its easy setup and reliable support, though a couple flag the free version's limits versus the paid tiers.

1. ★★★★★ Juan Martinez

   1mo ago

   I just wanted to take a moment to thank the WPForms team for creating such an outstanding product. WPForms has made it incredibly easy for me to create professional forms for my website, JMartinezService.com. The interface is intuitive, reliable, and has saved me a great deal of time. Even without advanced technical knowledge, I was able to build the forms I needed quickly and confidently. I truly appreciate the effort your team has put into developing and maintaining this excellent plugin. Thank you for providing such a valuable service and for helping small businesses like mine improve their online presence. Keep up the great work! Best regards, Juan MartinezJMartinezService.com

   Read on wp.org ↗
2. ★★★★★ einsrud

   1mo ago

   Easy to set up. Takes care of many features

   Read on wp.org ↗
3. ★★★★★ FraGue

   1mo ago

   Switched from Contact Form 7. Love it.

   Read on wp.org ↗
4. ★★★★★ smartpathshala14

   2mo ago

   WPForms is one of the best WordPress form plugins I have used. It is easy to set up, beginner-friendly, and works smoothly with contact forms, newsletter subscriptions, and custom forms. The drag-and-drop builder saves a lot of time, and the forms are responsive on both desktop and mobile. Overall, it’s a reliable plugin that I highly recommend for any WordPress website.

   Read on wp.org ↗
5. ★★★★★ matthewgotcha

   2mo ago

   The free version is a bit limited, but with the paid version, you can easily create all sorts of forms using templates. The code is very easy to embed, at least with WordPress.

   Read on wp.org ↗
6. ★★★★★ buzzmandt

   2mo ago

   works good and the free version has enough stuff to be functional

   Read on wp.org ↗
7. ★★★★★ hossammoghrabi

   2mo ago

   Simple to use, which is what i want

   Read on wp.org ↗
8. ★★★★★ electromatique974

   2mo ago

   pour le moment je suis satisfait

   Read on wp.org ↗

Recent releases and news for this plugin

1. 2026-08-19 Which Marketing Channels Bring Your Best Leads? One of the toughest decisions of running a business, especially in these times of changing search algorithms, AIO, AEO, GEO, and a huge list of other acronyms is that how much should you actually spen
2. 2026-08-18 Meet the New WPForms Ranking Field – Find Out What Your Audience Wants Most! Here's an uncomfortable truth about survey forms. You ask your audience to rate five ideas from 1 to 5. You collect hundreds of responses. You sit down to analyze the data and… everything scores betwe
3. 2026-08-12 Introducing the WPForms Mercado Pago Addon: Card Payments Built for Latin America Did you know that 83 million people use Mercado Pago every month? Last year alone, the platform processed $278 billion in payments. That scale reflects something much bigger than the popularity of a p
4. 2026-08-12 How to Stop People From Submitting Your WordPress Form More Than Once You open your WPForms entries and two rows look identical, same name and email address, submitted 40 seconds apart. Now you have to work out which one counts. That second entry might be a browser rese
5. 2026-08-06 How to Route Form Submissions to Different Lists and Tools Based on Answers In this guide, we'll show you how to route form data with conditional logic in WordPress, so every submission goes straight to the right inbox, the right email list, and the right tool the second it c
6. 2026-07-31 How to Connect WordPress Forms to Make.com Make is a visual automation platform that connects thousands of apps, and WPForms includes a native addon for it. Once the two are linked, every form submission can kick off a chain of actions on its

21 disclosed vulnerabilities on record for this plugin, all fixed in the current version. Sites on older versions stay exposed until they update.

1. Medium · 4.9 WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content ↗
   2026-07-20 CVE-2026-15782 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 2.0.0.1 Patched in 2.0.0.2
2. Medium · 5.3 WPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name ↗
   2026-06-30 CVE-2026-12127 Improper Neutralization of CRLF Sequences ('CRLF Injection') Affects <= 1.10.2 Patched in 1.10.2.1
3. Medium · 5.3 WPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint ↗
   2026-06-05 CVE-2026-7792 Insufficient Verification of Data Authenticity Affects <= 1.10.0.4 Patched in 1.10.0.5
4. Medium · 5.3 WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization ↗
   2026-05-28 CVE-2026-48835 Missing Authorization Affects <= 1.10.0.4 Patched in 1.10.0.5
5. Medium · 4.3 Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery ↗
   2026-03-31 CVE-2026-40764 Cross-Site Request Forgery (CSRF) Affects <= 1.10.0.2 Patched in 1.10.0.3
6. Medium · 5.3 WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure ↗
   2026-03-23 CVE-2026-25339 Exposure of Sensitive Information to an Unauthorized Actor Affects <= 1.9.8.7 Patched in 1.9.9.2
7. Medium · 4.3 Contact Form by WPForms <= 1.9.9.3 - Missing Authorization ↗
   2026-03-07 CVE-2026-32446 Missing Authorization Affects <= 1.9.9.3 Patched in 1.9.9.4
8. Medium · 5.4 WPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter ↗
   2025-05-09 CVE-2025-3794 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.9.5 Patched in 1.9.5.1
9. Medium · 6.4 WPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter ↗
   2025-02-03 CVE-2024-13403 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.9.3.1 Patched in 1.9.3.2
10. Medium · 4.3 Contact Form by WPForms <= 1.9.2.2 - Missing Authorization ↗
    2025-01-03 CVE-2024-56276 Missing Authorization Affects <= 1.9.2.2 Patched in 1.9.2.3
11. High · 8.5 WPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation ↗
    2024-12-09 CVE-2024-11205 Missing Authorization Affects 1.8.4 - 1.9.2.1 Patched in 1.9.2.2
12. Medium · 4.4 WPForms <= 1.9.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting ↗
    2024-12-05 CVE-2024-11223 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.9.2.2 Patched in 1.9.2.3
13. Medium · 4.3 WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion ↗
    2024-11-12 CVE-2024-10593 Cross-Site Request Forgery (CSRF) Affects <= 1.9.1.6 Patched in 1.9.2.1
14. Medium · 4.4 WPForms <= 1.9.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
    2024-11-04 CVE-2024-7056 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.9.1.5 Patched in 1.9.1.6
15. Medium · 5.3 Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation ↗
    2024-05-01 CVE-2024-3649 External Control of Assumed-Immutable Web Parameter Affects <= 1.8.7.2 Patched in 1.8.8.2
16. Medium · 6.1 Contact Form by WPForms (Free and Premium) <= 1.8.1.2 - Reflected Cross-Site Scripting ↗
    2023-06-20 CVE-2023-30500 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects <= 1.8.1.2 Patched in 1.8.1.3
17. Medium · 6.8 Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal ↗
    2022-09-19 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affects <= 1.7.5.3 Patched in 1.7.5.5
18. High · 7.2 Contact Form by WPForms <= 1.6.0.1 - Cross-Site Scripting ↗
    2020-05-21 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.6.0.2 Patched in 1.6.0.2
19. Medium · 6.4 Contact Form by WPForms <= 1.5.8.2 - Stored Cross-Site Scripting ↗
    2020-02-18 CVE-2020-10385 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.5.9 Patched in 1.5.9
20. High · 7.1 Contact Form by WPForms <= 1.4.8 - Reflected Cross-Site Scripting ↗
    2018-12-10 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.4.8.1 Patched in 1.4.8.1
21. Medium · 6.4 Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.4.7.2 - Stored Cross-Site Scripting ↗
    2018-09-18 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affects < 1.4.8 Patched in 1.4.8

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 48 languages, 7 at 90% or more

Plus 24 more locales with partial translations.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2026-06-15 6M+ → 5M+ down after 753 days in tier
2. 2024-05-23 5M+ → 6M+ up

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 700K+ installs · 4.8★ · 4 shared tags A
• Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More 300K+ installs · 4.8★ · 4 shared tags A
• Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI 90K+ installs · 4.8★ · 4 shared tags A
• Ultra Addons for Contact Form 7 60K+ installs · 4.7★ · 4 shared tags A
• Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder 20K+ installs · 4.2★ · 4 shared tags A
• Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms 20K+ installs · 4.4★ · 4 shared tags A

Embed this report card

Drop a live Pulse card for WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More into a readme, a review or a deck. It updates itself.

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More: 5M+ active installs, 4.8★ (14,366 reviews). Plugin Pulse (WP Mayor), as of 2026-08-25. https://plugins.wpmayor.com/plugin/wpforms-lite