WP-Safety

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Security & Risk Analysis

wordpress.org/plugins/formidable

The most advanced WordPress forms plugin. Go beyond contact forms with our drag and drop form builder for surveys, quizzes, and more.

300K active installs v6.29 PHP 7.0+ WP 6.3+ Updated Mar 11, 2026
custom-formform-builderformspayment-formsurvey
76
B · Generally Safe
CVEs total23
Unpatched0
Last CVEMar 12, 2026
Plugin page Download
Safety Verdict

Is Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Safe to Use in 2026?

Mostly Safe

Score 76/100

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder is generally safe to use. 23 past CVEs were resolved. Keep it updated.

23 known CVEsLast CVE: Mar 12, 2026Updated 22d ago
Risk Assessment

Formidable version 6.29 presents a mixed security posture. While the plugin demonstrates good practices in SQL query preparation and output escaping, significant concerns arise from its attack surface and historical vulnerability data. The vast majority of AJAX handlers and REST API routes lack proper authorization checks, creating a large potential entry point for attackers. This is further exacerbated by the presence of the `unserialize` function, which, while not directly flagged in taint analysis, is a known risk for deserialization vulnerabilities if user-controlled data is passed to it without strict validation. The plugin's history of 23 known CVEs, including critical and high-severity issues across various categories such as authorization bypass, XSS, and SQL injection, indicates a recurring pattern of security weaknesses. The fact that there are currently no unpatched CVEs is positive, but the sheer volume and variety of past vulnerabilities suggest that the plugin's development team has historically struggled with robust security implementation.

Despite the high percentage of prepared SQL statements and properly escaped output, the unprotected entry points and past vulnerability trends are major red flags. The lack of permission callbacks on REST API routes and the large number of unprotected AJAX handlers are critical weaknesses that could be exploited by authenticated or even unauthenticated users. The presence of the `unserialize` function, even without a direct taint flow indicating a current exploit, is a latent risk that requires careful management. The plugin's strengths lie in its handling of SQL and output, but these are overshadowed by the significant attack surface and a history of critical security flaws.

Key Concerns

  • Large attack surface without auth checks (AJAX)
  • Large attack surface without auth checks (REST API)
  • Presence of dangerous function (unserialize)
  • High number of total known CVEs (23)
  • History of critical CVEs (4)
  • History of high severity CVEs (5)
Vulnerabilities
23

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Security Vulnerabilities

CVEs by Year

2 CVEs in 2016
2016
4 CVEs in 2017
2017
1 CVE in 2019
2019
2 CVEs in 2021
2021
2 CVEs in 2022
2022
4 CVEs in 2023
2023
6 CVEs in 2024
2024
2 CVEs in 2026
2026
Patched Has unpatched

Severity Breakdown

Critical
4
High
5
Medium
14

23 total CVEs

CVE-2026-2888medium · 5.3Authorization Bypass Through User-Controlled Key

Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter

Mar 12, 2026 Patched in 6.29 (1d)
CVE-2026-2890high · 7.5Missing Authorization

Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse

Mar 12, 2026 Patched in 6.29 (1d)
CVE-2024-11188medium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter

Nov 22, 2024 Patched in 6.16.2 (1d)
CVE-2024-9768medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting

Oct 31, 2024 Patched in 6.14.1 (43d)
CVE-2024-6725medium · 4.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Jul 30, 2024 Patched in 6.11.2 (1d)
CVE-2024-0660medium · 6.1Cross-Site Request Forgery (CSRF)

Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Jan 26, 2024 Patched in 6.8 (186d)
CVE-2023-6842medium · 4.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting

Jan 8, 2024 Patched in 6.7.1 (204d)
CVE-2023-6830medium · 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Forms <= 6.7 - HTML Injection

Jan 8, 2024 Patched in 6.7.1 (204d)
CVE-2023-2877medium · 6.5Missing Authorization

Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation

May 31, 2023 Patched in 6.3.1 (237d)
CVE-2023-1405critical · 9.8Deserialization of Untrusted Data

Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection

Apr 6, 2023 Patched in 6.2 (292d)
CVE-2023-0816medium · 5.3Reliance on Untrusted Inputs in a Security Decision

Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header

Mar 6, 2023 Patched in 6.1 (323d)
CVE-2023-24419high · 7.1Cross-Site Request Forgery (CSRF)

Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery

Feb 1, 2023 Patched in 5.5.7 (356d)
CVE-2022-45806medium · 5.4Cross-Site Request Forgery (CSRF)

Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery

Dec 16, 2022 Patched in 5.5.5 (403d)
WF-f28feb11-7e28-4b97-b529-f6d266c3e534-formidablemedium · 4.7Server-Side Request Forgery (SSRF)

Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery

Dec 16, 2022 Patched in 5.5.5 (403d)
CVE-2021-24608medium · 4.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting

Oct 6, 2021 Patched in 5.0.07 (839d)
CVE-2021-24884critical · 9.6Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting

Jan 28, 2021 Patched in 4.09.05 (1090d)
CVE-2019-15780critical · 9.8Deserialization of Untrusted Data

Formidable Form Builder <= 4.02 - PHP Object Injection

Aug 9, 2019 Patched in 4.02.01 (1628d)
WF-27616d9e-c1eb-489f-ace7-76c0e5be2597-formidablehigh · 8.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Formidable Form Builder < 2.05.03 - SQL Injection

Nov 13, 2017 Patched in 2.05.03 (2262d)
CVE-2017-20192high · 8.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting

Nov 13, 2017 Patched in 2.05.03 (2529d)
WF-c0e6f20a-3a5c-4782-9852-9891b93d765f-formidablemedium · 6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting

Nov 13, 2017 Patched in 2.05.03 (2262d)
CVE-2017-20194medium · 5.3Exposure of Sensitive Information to an Unauthorized Actor

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

Nov 12, 2017 Patched in 2.05.03 (2530d)
WF-faed1198-b8c4-46b1-b6a6-5fc35cd7bdf8-formidablecritical · 9.1Improper Access Control

Formidable Form Builder <= 2.0.21 - Missing Authorization Checks

Feb 16, 2016 Patched in 2.0.22 (2898d)
CVE-2014-9309high · 8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Formidable Form Builder <= 1.07.11 - SQL Injection

Jan 26, 2016 Patched in 2.0 (2919d)
Code Analysis
Analyzed Mar 16, 2026

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Code Analysis

Dangerous Functions
3
Raw SQL Queries
16
79 prepared
Unescaped Output
132
3516 escaped
Nonce Checks
68
Capability Checks
67
File Operations
9
External Requests
10
Bundled Libraries
0

Dangerous Functions Found

unserializereturn unserialize( serialize( $settings ) );classes\models\FrmSettings.php:277
unserialize$this->settings = unserialize( serialize( $settings ) );square\models\FrmSquareLiteSettings.php:72
unserialize$this->settings = unserialize( serialize( $settings ) );stripe\models\FrmStrpLiteSettings.php:74

SQL Query Safety

83% prepared95 total queries

Output Escaping

96% escaped3648 total outputs
Data Flows
All sanitized

Data Flow Analysis

4 flows
<FrmAppHelper> (classes\helpers\FrmAppHelper.php:0)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface
78 unprotected

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Attack Surface

Entry Points80
Unprotected78

AJAX Handlers 76

authwp_ajax_frm_installclasses\controllers\FrmHooksController.php:232
authwp_ajax_frm_uninstallclasses\controllers\FrmHooksController.php:233
authwp_ajax_frm_deauthorizeclasses\controllers\FrmHooksController.php:234
authwp_ajax_frm_onboarding_consent_trackingclasses\controllers\FrmHooksController.php:237
authwp_ajax_frm_onboarding_setup_usage_dataclasses\controllers\FrmHooksController.php:238
authwp_ajax_frm_addon_activateclasses\controllers\FrmHooksController.php:241
authwp_ajax_frm_addon_deactivateclasses\controllers\FrmHooksController.php:242
authwp_ajax_frm_activate_addonclasses\controllers\FrmHooksController.php:243
authwp_ajax_frm_deactivate_addonclasses\controllers\FrmHooksController.php:244
authwp_ajax_frm_install_addonclasses\controllers\FrmHooksController.php:245
authwp_ajax_frm_uninstall_addonclasses\controllers\FrmHooksController.php:246
authwp_ajax_frm_install_pluginclasses\controllers\FrmHooksController.php:248
authwp_ajax_frm_check_plugin_activationclasses\controllers\FrmHooksController.php:249
authwp_ajax_frm_load_fieldclasses\controllers\FrmHooksController.php:252
authwp_ajax_frm_insert_fieldclasses\controllers\FrmHooksController.php:253
authwp_ajax_frm_duplicate_fieldclasses\controllers\FrmHooksController.php:254
authwp_ajax_frm_delete_fieldclasses\controllers\FrmHooksController.php:255
authwp_ajax_frm_import_optionsclasses\controllers\FrmHooksController.php:256
authwp_ajax_frm_add_form_actionclasses\controllers\FrmHooksController.php:259
authwp_ajax_frm_form_action_fillclasses\controllers\FrmHooksController.php:260
authwp_ajax_frm_save_formclasses\controllers\FrmHooksController.php:263
authwp_ajax_frm_rename_formclasses\controllers\FrmHooksController.php:264
authwp_ajax_frm_get_default_htmlclasses\controllers\FrmHooksController.php:265
authwp_ajax_frm_get_shortcode_optsclasses\controllers\FrmHooksController.php:266
authwp_ajax_frm_forms_previewclasses\controllers\FrmHooksController.php:267
noprivwp_ajax_frm_forms_previewclasses\controllers\FrmHooksController.php:268
authwp_ajax_frm_forms_trashclasses\controllers\FrmHooksController.php:269
authwp_ajax_frm_install_formclasses\controllers\FrmHooksController.php:270
authwp_ajax_frm_create_page_with_shortcodeclasses\controllers\FrmHooksController.php:271
authwp_ajax_get_page_dropdownclasses\controllers\FrmHooksController.php:272
authwp_ajax_frm_dismiss_migratorclasses\controllers\FrmHooksController.php:274
authwp_ajax_frm_add_or_remove_favorite_templateclasses\controllers\FrmHooksController.php:277
authwp_ajax_frm_create_templateclasses\controllers\FrmHooksController.php:278
authwp_ajax_frm_get_free_templatesclasses\controllers\FrmHooksController.php:279
authwp_ajax_frm_inbox_dismissclasses\controllers\FrmHooksController.php:282
authwp_ajax_frm_lite_settings_upgradeclasses\controllers\FrmHooksController.php:285
authwp_ajax_frm_settings_tabclasses\controllers\FrmHooksController.php:286
authwp_ajax_frm_page_searchclasses\controllers\FrmHooksController.php:287
authwp_ajax_frm_settings_resetclasses\controllers\FrmHooksController.php:290
authwp_ajax_frm_change_stylingclasses\controllers\FrmHooksController.php:291
authwp_ajax_frmpro_load_cssclasses\controllers\FrmHooksController.php:292
noprivwp_ajax_frmpro_load_cssclasses\controllers\FrmHooksController.php:293
authwp_ajax_frmpro_cssclasses\controllers\FrmHooksController.php:294
noprivwp_ajax_frmpro_cssclasses\controllers\FrmHooksController.php:295
authwp_ajax_frm_rename_styleclasses\controllers\FrmHooksController.php:296
authwp_ajax_frm_install_templateclasses\controllers\FrmHooksController.php:299
authwp_ajax_frm_entries_csvclasses\controllers\FrmHooksController.php:300
noprivwp_ajax_frm_entries_csvclasses\controllers\FrmHooksController.php:301
authwp_ajax_frm_export_xmlclasses\controllers\FrmHooksController.php:302
authwp_ajax_dashboard_ajax_actionclasses\controllers\FrmHooksController.php:305
authwp_ajax_frm_track_flowsclasses\controllers\FrmHooksController.php:312
authwp_ajax_frm_get_applications_dataclasses\controllers\FrmHooksController.php:315
authwp_ajax_frm_dismiss_reviewclasses\controllers\FrmHooksController.php:318
authwp_ajax_frm_small_screen_proceedclasses\controllers\FrmHooksController.php:319
authwp_ajax_frm_sale_banner_dismissclasses\controllers\FrmHooksController.php:320
authwp_ajax_frm_email_style_previewclasses\controllers\FrmHooksController.php:322
authwp_ajax_frm_send_test_emailclasses\controllers\FrmHooksController.php:323
authwp_ajax_frm_mark_checklist_step_as_completedclasses\controllers\FrmHooksController.php:326
authwp_ajax_frm_dismiss_welcome_tourclasses\controllers\FrmHooksController.php:327
authwp_ajax_frm_smtp_page_check_plugin_statusclasses\controllers\FrmSMTPController.php:56
authwp_ajax_frm_square_oauthsquare\controllers\FrmSquareLiteHooksController.php:39
authwp_ajax_frm_square_disconnectsquare\controllers\FrmSquareLiteHooksController.php:40
authwp_ajax_frm_verify_buyersquare\controllers\FrmSquareLiteHooksController.php:42
noprivwp_ajax_frm_verify_buyersquare\controllers\FrmSquareLiteHooksController.php:43
noprivwp_ajax_frm_square_process_eventssquare\controllers\FrmSquareLiteHooksController.php:46
authwp_ajax_frm_square_process_eventssquare\controllers\FrmSquareLiteHooksController.php:47
noprivwp_ajax_frm_square_lite_verifysquare\controllers\FrmSquareLiteHooksController.php:50
noprivwp_ajax_frm_strp_process_eventsstripe\controllers\FrmStrpLiteHooksController.php:86
authwp_ajax_frm_strp_process_eventsstripe\controllers\FrmStrpLiteHooksController.php:87
noprivwp_ajax_frm_strp_amountstripe\controllers\FrmStrpLiteHooksController.php:88
authwp_ajax_frm_strp_amountstripe\controllers\FrmStrpLiteHooksController.php:89
noprivwp_ajax_frmstrplinkreturnstripe\controllers\FrmStrpLiteHooksController.php:92
authwp_ajax_frmstrplinkreturnstripe\controllers\FrmStrpLiteHooksController.php:93
noprivwp_ajax_frm_strp_lite_verifystripe\controllers\FrmStrpLiteHooksController.php:96
authwp_ajax_frm_trans_refundstripe\controllers\FrmTransLiteHooksController.php:87
authwp_ajax_frm_trans_cancelstripe\controllers\FrmTransLiteHooksController.php:88

REST API Routes 2

GET/wp-json/frm-admin/v1/installclasses\controllers\FrmAppController.php:1126
GET/wp-json/frm-admin/v1/install-addonclasses\controllers\FrmAppController.php:1134

Shortcodes 2

[formidable] classes\controllers\FrmHooksController.php:89
[input] classes\views\frm-entries\form.php:157
WordPress Hooks 261
actionadmin_menuclasses\controllers\FrmAddonsController.php:34
filterpre_set_site_transient_update_pluginsclasses\controllers\FrmAddonsController.php:35
actionadmin_enqueue_scriptsclasses\controllers\FrmAddonsController.php:43
filterfrm_show_footer_linksclasses\controllers\FrmAddonsController.php:44
actionadmin_footerclasses\controllers\FrmAppController.php:446
actionadmin_footerclasses\controllers\FrmAppController.php:504
actionadmin_noticesclasses\controllers\FrmAppController.php:1176
filterfrm_show_footer_linksclasses\controllers\FrmAppController.php:1376
actionadmin_menuclasses\controllers\FrmDashboardController.php:24
filterfrm_show_footer_linksclasses\controllers\FrmDashboardController.php:50
filterscreen_options_show_screenclasses\controllers\FrmDashboardController.php:51
actionelementor/editor/after_enqueue_stylesclasses\controllers\FrmElementorController.php:18
actionwp_print_footer_scriptsclasses\controllers\FrmEntriesAJAXSubmitController.php:123
filterscreen_options_show_screenclasses\controllers\FrmEntriesController.php:104
actionfrm_form_actions_initclasses\controllers\FrmFormActionsController.php:814
filterget_user_option_managetoplevel_page_formidablecolumnshiddenclasses\controllers\FrmFormsController.php:45
filtermanage_toplevel_page_formidable_columnsclasses\controllers\FrmFormsController.php:47
filtermanage_toplevel_page_formidable_sortable_columnsclasses\controllers\FrmFormsController.php:48
actionwp_enqueue_scriptsclasses\controllers\FrmFormsController.php:486
filterfrm_filter_final_formclasses\controllers\FrmFormsController.php:487
filterwp_titleclasses\controllers\FrmFormsController.php:567
filterthe_titleclasses\controllers\FrmFormsController.php:568
filterthe_contentclasses\controllers\FrmFormsController.php:569
actionloop_no_resultsclasses\controllers\FrmFormsController.php:570
filteris_active_sidebarclasses\controllers\FrmFormsController.php:571
filterbody_classclasses\controllers\FrmFormsController.php:579
filterfrm_filter_final_formclasses\controllers\FrmFormsController.php:621
filterscript_loader_srcclasses\controllers\FrmFormsController.php:790
actionwp_enqueue_editorclasses\controllers\FrmFormsController.php:1490
filterfrm_validate_formclasses\controllers\FrmFormsController.php:2123
actionfrm_load_form_hooksclasses\controllers\FrmFormsController.php:2134
actionwp_before_admin_bar_renderclasses\controllers\FrmFormsController.php:2293
actionfrm_load_form_hooksclasses\controllers\FrmFormsController.php:2450
filterthe_contentclasses\controllers\FrmFormsController.php:3025
filterfrm_use_wpautopclasses\controllers\FrmFormsController.php:3038
filterfrm_redirect_urlclasses\controllers\FrmFormsController.php:3048
filterfrm_use_wpautopclasses\controllers\FrmFormsController.php:3177
filterscript_loader_tagclasses\controllers\FrmFormsController.php:3441
actionadmin_menuclasses\controllers\FrmFormTemplatesController.php:153
actionadmin_footerclasses\controllers\FrmFormTemplatesController.php:154
filterfrm_form_nav_listclasses\controllers\FrmFormTemplatesController.php:155
actionadmin_initclasses\controllers\FrmFormTemplatesController.php:161
actionadmin_enqueue_scriptsclasses\controllers\FrmFormTemplatesController.php:162
filterfrm_show_footer_linksclasses\controllers\FrmFormTemplatesController.php:163
actioninitclasses\controllers\FrmHooksController.php:63
actionrest_api_initclasses\controllers\FrmHooksController.php:65
filterwidget_textclasses\controllers\FrmHooksController.php:66
actionwp_loadedclasses\controllers\FrmHooksController.php:69
actionfrm_after_entry_processedclasses\controllers\FrmHooksController.php:70
actioninitclasses\controllers\FrmHooksController.php:73
actionfrm_after_create_entryclasses\controllers\FrmHooksController.php:74
filterpre_wpml_is_translated_post_typeclasses\controllers\FrmHooksController.php:75
actionwidgets_initclasses\controllers\FrmHooksController.php:78
actioninitclasses\controllers\FrmHooksController.php:79
filterfrm_contentclasses\controllers\FrmHooksController.php:80
filterfrm_replace_content_shortcodesclasses\controllers\FrmHooksController.php:81
actionadmin_bar_initclasses\controllers\FrmHooksController.php:82
actionwp_footerclasses\controllers\FrmHooksController.php:83
actionwp_footerclasses\controllers\FrmHooksController.php:84
actionwp_scheduled_deleteclasses\controllers\FrmHooksController.php:86
actioninitclasses\controllers\FrmHooksController.php:92
filterfrm_get_style_optsclasses\controllers\FrmHooksController.php:93
filterfrm_add_form_style_classclasses\controllers\FrmHooksController.php:94
filterfrm_show_entry_stylesclasses\controllers\FrmHooksController.php:95
actioninitclasses\controllers\FrmHooksController.php:98
filtercron_schedulesclasses\controllers\FrmHooksController.php:100
actionformidable_send_usageclasses\controllers\FrmHooksController.php:101
filterfrm_keep_name_value_arrayclasses\controllers\FrmHooksController.php:107
actionelementor/widgets/registerclasses\controllers\FrmHooksController.php:110
actionfrm_daily_eventclasses\controllers\FrmHooksController.php:113
filterfrm_is_field_requiredclasses\controllers\FrmHooksController.php:120
actionadmin_menuclasses\controllers\FrmHooksController.php:127
filteradmin_body_classclasses\controllers\FrmHooksController.php:128
actionadmin_noticesclasses\controllers\FrmHooksController.php:129
actionadmin_initclasses\controllers\FrmHooksController.php:130
actionadmin_enqueue_scriptsclasses\controllers\FrmHooksController.php:131
filteradmin_footer_textclasses\controllers\FrmHooksController.php:133
actionadmin_footerclasses\controllers\FrmHooksController.php:134
actioncurrent_screenclasses\controllers\FrmHooksController.php:135
actionadmin_menuclasses\controllers\FrmHooksController.php:138
filterset-screen-optionclasses\controllers\FrmHooksController.php:139
filterupdate_user_metadataclasses\controllers\FrmHooksController.php:140
actionupdated_user_metaclasses\controllers\FrmHooksController.php:141
actionfrm_before_update_form_settingsclasses\controllers\FrmHooksController.php:145
actionfrm_after_duplicate_formclasses\controllers\FrmHooksController.php:148
filterfrm_pro_available_fieldsclasses\controllers\FrmHooksController.php:151
actionadmin_menuclasses\controllers\FrmHooksController.php:154
actionadmin_head-toplevel_page_formidableclasses\controllers\FrmHooksController.php:155
actionfrm_after_field_optionsclasses\controllers\FrmHooksController.php:156
filterfrm_fields_in_form_builderclasses\controllers\FrmHooksController.php:157
filterset-screen-optionclasses\controllers\FrmHooksController.php:159
actionadmin_footerclasses\controllers\FrmHooksController.php:160
actionelementor/editor/footerclasses\controllers\FrmHooksController.php:163
actionmedia_buttonsclasses\controllers\FrmHooksController.php:165
actionet_pb_admin_excluded_shortcodesclasses\controllers\FrmHooksController.php:166
actionfrm_after_duplicate_formclasses\controllers\FrmHooksController.php:169
actionadmin_menuclasses\controllers\FrmHooksController.php:172
actionfrm_before_settingsclasses\controllers\FrmHooksController.php:173
actionfrm_after_settings_tabsclasses\controllers\FrmHooksController.php:174
actionadmin_menuclasses\controllers\FrmHooksController.php:177
actionplugins_loadedclasses\controllers\FrmHooksController.php:178
actionadmin_initclasses\controllers\FrmHooksController.php:179
actionwp_default_stylesclasses\controllers\FrmHooksController.php:181
actionadmin_menuclasses\controllers\FrmHooksController.php:184
actionenqueue_block_editor_assetsclasses\controllers\FrmHooksController.php:187
actionenqueue_block_assetsclasses\controllers\FrmHooksController.php:188
actionadmin_initclasses\controllers\FrmHooksController.php:190
actionadmin_menuclasses\controllers\FrmHooksController.php:194
actionadmin_enqueue_scriptsclasses\controllers\FrmHooksController.php:195
filterfrm_setup_edit_field_varsclasses\controllers\FrmHooksController.php:198
actionadmin_initclasses\controllers\FrmHooksController.php:204
actionadmin_menuclasses\controllers\FrmHooksController.php:207
actionadmin_enqueue_scriptsclasses\controllers\FrmHooksController.php:210
actionadmin_footerclasses\controllers\FrmHooksController.php:211
actiondeactivated_pluginclasses\controllers\FrmHooksController.php:212
actionfrm_email_styles_extra_settingsclasses\controllers\FrmHooksController.php:214
actionadmin_initclasses\controllers\FrmHooksController.php:216
actionwp_loadedclasses\controllers\FrmHooksController.php:309
filterfrm_field_typeclasses\controllers\FrmHooksController.php:335
actionfrm_field_input_htmlclasses\controllers\FrmHooksController.php:336
filterfrm_field_value_savedclasses\controllers\FrmHooksController.php:337
filterfrm_field_label_seenclasses\controllers\FrmHooksController.php:338
actionfrm_form_classesclasses\controllers\FrmHooksController.php:341
filterfrm_submit_button_classclasses\controllers\FrmHooksController.php:342
filterfrm_back_button_classclasses\controllers\FrmHooksController.php:343
filterfrm_pre_display_formclasses\controllers\FrmHooksController.php:345
filterfrm_use_important_widthclasses\controllers\FrmHooksController.php:348
actionwpmu_upgrade_siteclasses\controllers\FrmHooksController.php:362
filterwpmu_drop_tablesclasses\controllers\FrmHooksController.php:365
actionadmin_initclasses\controllers\FrmOnboardingWizardController.php:128
filteroption_frm_inboxclasses\controllers\FrmOnboardingWizardController.php:131
actionadmin_menuclasses\controllers\FrmOnboardingWizardController.php:214
actionadmin_initclasses\controllers\FrmOnboardingWizardController.php:215
actionadmin_enqueue_scriptsclasses\controllers\FrmOnboardingWizardController.php:216
actionadmin_headclasses\controllers\FrmOnboardingWizardController.php:217
filteradmin_body_classclasses\controllers\FrmOnboardingWizardController.php:219
filterfrm_show_footer_linksclasses\controllers\FrmOnboardingWizardController.php:220
filterwp_mail_smtp_is_white_labeledclasses\controllers\FrmSMTPController.php:51
filterwp_mail_smtp_core_get_upgrade_linkclasses\controllers\FrmSMTPController.php:59
actionadmin_menuclasses\controllers\FrmSMTPController.php:60
actionwp_mail_smtp_core_recommendations_pluginsclasses\controllers\FrmSMTPController.php:61
actionadmin_initclasses\controllers\FrmSMTPController.php:68
filterget_frm_stylesheetclasses\controllers\FrmStylesController.php:105
actionfrm_update_settingsclasses\controllers\FrmStylesController.php:158
filterstyle_loader_tagclasses\controllers\FrmStylesController.php:217
filterfrm_submit_button_classclasses\controllers\FrmStylesController.php:455
filterfrm_add_form_style_classclasses\controllers\FrmStylesController.php:687
filterfrm_should_show_floating_linksclasses\controllers\FrmWelcomeTourController.php:71
filteradmin_body_classclasses\controllers\FrmWelcomeTourController.php:72
actionadmin_enqueue_scriptsclasses\controllers\FrmWelcomeTourController.php:73
actionadmin_footerclasses\controllers\FrmWelcomeTourController.php:76
actionadmin_footerclasses\controllers\FrmWelcomeTourController.php:80
actionfrm_after_changed_form_styleclasses\controllers\FrmWelcomeTourController.php:81
actionfrm_after_saved_styleclasses\controllers\FrmWelcomeTourController.php:82
filtersafe_style_cssclasses\helpers\FrmAppHelper.php:1085
filterfrm_striphtml_allowed_tagsclasses\helpers\FrmAppHelper.php:1086
filtersafe_style_cssclasses\helpers\FrmAppHelper.php:1420
filtersafecss_filter_attr_allow_cssclasses\helpers\FrmAppHelper.php:1421
filterfrm_striphtml_allowed_tagsclasses\helpers\FrmAppHelper.php:1422
filteroption_gmt_offsetclasses\helpers\FrmAppHelper.php:4739
filterfrm_message_listclasses\helpers\FrmAppHelper.php:4846
filterformidable_page_formidable_entries_per_pageclasses\helpers\FrmDashboardHelper.php:374
filterfrm_submit_buttonclasses\helpers\FrmFormsHelper.php:936
actionadmin_footerclasses\helpers\FrmListHelper.php:150
filterfrm_style_card_paramsclasses\helpers\FrmStylesCardHelper.php:249
filterfrm_run_antispamclasses\helpers\FrmStylesPreviewHelper.php:53
filterfrm_run_honeypotclasses\helpers\FrmStylesPreviewHelper.php:56
filterfrm_html_label_positionclasses\helpers\FrmStylesPreviewHelper.php:72
filterfrm_field_div_classesclasses\helpers\FrmStylesPreviewHelper.php:90
filterfrm_show_normal_field_typeclasses\helpers\FrmStylesPreviewHelper.php:117
filterfrm_form_objectclasses\helpers\FrmStylesPreviewHelper.php:144
filterfrm_is_adminclasses\helpers\FrmStylesPreviewHelper.php:168
filterfrm_installed_addonsclasses\models\FrmAddon.php:123
filterfrm_include_addon_pageclasses\models\FrmAddon.php:131
filterplugins_apiclasses\models\FrmAddon.php:169
filtersite_transient_update_pluginsclasses\models\FrmAddon.php:172
filterfrm_form_attributesclasses\models\FrmAntiSpam.php:43
filterfrm_form_div_attributesclasses\models\FrmAntiSpam.php:44
filtermandrill_nl2brclasses\models\FrmEmail.php:903
filterthe_contentclasses\models\FrmEntryValidate.php:346
filterposts_whereclasses\models\FrmFormAction.php:739
actionfrm_import_settingsclasses\models\FrmFormMigrator.php:84
filterscreen_options_show_screenclasses\models\FrmInbox.php:485
actionfrm_trigger_email_actionclasses\models\FrmNotification.php:53
filterwp_privacy_personal_data_erasersclasses\models\FrmPersonalData.php:19
filterwp_privacy_personal_data_exportersclasses\models\FrmPersonalData.php:20
actioncurrent_screenclasses\models\FrmPluginSearch.php:23
filterplugins_api_resultclasses\models\FrmPluginSearch.php:41
filterself_admin_urlclasses\models\FrmPluginSearch.php:42
filterplugin_install_action_linksclasses\models\FrmPluginSearch.php:43
actionadmin_enqueue_scriptsclasses\models\FrmPluginSearch.php:44
actionadmin_initclasses\models\FrmSalesApi.php:531
actionplugins_loadedclasses\models\FrmSolution.php:49
actionadmin_initclasses\models\FrmSolution.php:50
filterfrm_add_settings_sectionclasses\models\FrmSolution.php:70
actionadmin_menuclasses\models\FrmSolution.php:82
actionadmin_headclasses\models\FrmSolution.php:83
filterdocument_titleclasses\views\frm-entries\direct.php:6
filterfrm_striphtml_allowed_tagsclasses\views\shared\errors.php:33
actionplugins_loadedformidable.php:31
actionfrm_enqueue_form_scriptssquare\controllers\FrmSquareLiteHooksController.php:12
filterfrm_validate_credit_card_field_entrysquare\controllers\FrmSquareLiteHooksController.php:13
filterfrm_payment_gatewayssquare\controllers\FrmSquareLiteHooksController.php:15
actioninitsquare\controllers\FrmSquareLiteHooksController.php:17
filterfrm_pro_show_card_callbacksquare\controllers\FrmSquareLiteHooksController.php:20
filterfrm_add_settings_sectionsquare\controllers\FrmSquareLiteHooksController.php:27
actionfrm_update_settingssquare\controllers\FrmSquareLiteHooksController.php:28
filterfrm_setup_new_fields_varsstripe\controllers\FrmStrpLiteAppController.php:182
actionfrm_filter_final_formstripe\controllers\FrmStrpLiteAppController.php:216
actionfrm_entry_formstripe\controllers\FrmStrpLiteHooksController.php:18
actionfrm_enqueue_form_scriptsstripe\controllers\FrmStrpLiteHooksController.php:19
actioninitstripe\controllers\FrmStrpLiteHooksController.php:20
filterfrm_saved_errorsstripe\controllers\FrmStrpLiteHooksController.php:23
filterfrm_filter_final_formstripe\controllers\FrmStrpLiteHooksController.php:24
filterfrm_setup_edit_entry_varsstripe\controllers\FrmStrpLiteHooksController.php:25
filterfrm_pro_show_card_callbackstripe\controllers\FrmStrpLiteHooksController.php:27
filterfrm_fields_in_entries_list_tablestripe\controllers\FrmStrpLiteHooksController.php:30
filterfrm_payment_gatewaysstripe\controllers\FrmStrpLiteHooksController.php:47
filterfrm_validate_credit_card_field_entrystripe\controllers\FrmStrpLiteHooksController.php:48
filterfrm_form_objectstripe\controllers\FrmStrpLiteHooksController.php:51
actionfrm_form_classesstripe\controllers\FrmStrpLiteHooksController.php:52
actionfrm_after_uninstallstripe\controllers\FrmStrpLiteHooksController.php:65
filterfrm_add_settings_sectionstripe\controllers\FrmStrpLiteHooksController.php:66
actionadmin_initstripe\controllers\FrmStrpLiteHooksController.php:67
actionfrm_update_settingsstripe\controllers\FrmStrpLiteHooksController.php:68
filterfrm_pay_action_defaultsstripe\controllers\FrmStrpLiteHooksController.php:71
filterfrm_before_save_payment_actionstripe\controllers\FrmStrpLiteHooksController.php:72
filterfrm_pay_stripe_receiptstripe\controllers\FrmStrpLiteHooksController.php:73
filterfrm_sub_stripe_receiptstripe\controllers\FrmStrpLiteHooksController.php:74
actionfrm_messages_settings_formstripe\controllers\FrmStrpLiteSettingsController.php:22
filterfrm_success_filterstripe\controllers\FrmTransLiteActionsController.php:137
filterfrm_pre_display_formstripe\controllers\FrmTransLiteActionsController.php:138
filterfrm_main_feedbackstripe\controllers\FrmTransLiteActionsController.php:139
filterfrm_setup_new_fields_varsstripe\controllers\FrmTransLiteActionsController.php:140
actionfrm_entry_formstripe\controllers\FrmTransLiteActionsController.php:547
actionfrm_entry_shared_sidebar_middlestripe\controllers\FrmTransLiteEntriesController.php:18
actionfrm_add_form_option_sectionstripe\controllers\FrmTransLiteHooksController.php:12
actionfrm_payment_cronstripe\controllers\FrmTransLiteHooksController.php:20
filterfrm_registered_form_actionsstripe\controllers\FrmTransLiteHooksController.php:21
actionfrm_add_form_option_sectionstripe\controllers\FrmTransLiteHooksController.php:22
actionfrm_trigger_payment_actionstripe\controllers\FrmTransLiteHooksController.php:23
filterfrm_action_triggersstripe\controllers\FrmTransLiteHooksController.php:26
filterfrm_email_action_optionsstripe\controllers\FrmTransLiteHooksController.php:27
filterfrm_twilio_action_optionsstripe\controllers\FrmTransLiteHooksController.php:28
filterfrm_mailchimp_action_optionsstripe\controllers\FrmTransLiteHooksController.php:29
filterfrm_api_action_optionsstripe\controllers\FrmTransLiteHooksController.php:30
filterfrm_setup_new_fields_varsstripe\controllers\FrmTransLiteHooksController.php:31
filterfrm_setup_edit_fields_varsstripe\controllers\FrmTransLiteHooksController.php:32
actionfrm_pay_show_square_optionsstripe\controllers\FrmTransLiteHooksController.php:40
actionadmin_headstripe\controllers\FrmTransLiteHooksController.php:43
actionadmin_menustripe\controllers\FrmTransLiteHooksController.php:52
actionadmin_headstripe\controllers\FrmTransLiteHooksController.php:53
actionfrm_show_entry_sidebarstripe\controllers\FrmTransLiteHooksController.php:54
actionfrm_after_installstripe\controllers\FrmTransLiteHooksController.php:55
filterset-screen-optionstripe\controllers\FrmTransLiteHooksController.php:58
filterfrm_before_save_payment_actionstripe\controllers\FrmTransLiteHooksController.php:61
actionadmin_menustripe\controllers\FrmTransLiteHooksController.php:80
filterscreen_options_show_screenstripe\controllers\FrmTransLiteListsController.php:16
filterfrm_striphtml_allowed_tagsstripe\helpers\FrmTransLiteAppHelper.php:420
filterfrm_contentstripe\models\FrmStrpLiteAuth.php:68
filterfrm_redirect_urlstripe\models\FrmStrpLiteAuth.php:775

Scheduled Events 2

formidable_send_usage
frm_payment_cron
Maintenance & Trust

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Maintenance & Trust

Maintenance Signals

WordPress version tested6.9.4
Last updatedMar 11, 2026
PHP min version7.0
Downloads26.4M

Community Trust

Rating96/100
Number of ratings1,355
Active installs300K
Alternatives

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Alternatives

SureForms – Contact Form, Payment Form & Other Custom Form Builder

SureForms – Contact Form, Payment Form & Other Custom Form Builder

sureforms

A
88

The most beginner-friendly, AI Form Builder for WordPress to create contact forms, payment forms & other custom forms with advanced features, with &hellip;

400K 15 CVEs
Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder

everest-forms

B
84

The best WordPress form builder. Create contact forms, payment forms, conversational forms, custom forms, surveys, & quizzes using drag and drop.

100K 12 CVEs
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More

wpforms-lite

A
90

The best WordPress contact form plugin. Drag & Drop form builder to create beautiful contact forms, payment forms, & other custom forms.

6.0M 13 CVEs
Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder

fluentform

B
82

Get a fast contact form plugin. Create advanced forms using drag and drop form builder with all smart features.

600K 27 CVEs
Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

forminator

B
76

Best WordPress form builder plugin. Create contact forms, payment forms & order forms with 1000+ integrations.

600K 36 CVEs
Developer Profile

Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Developer Profile

Strategy11 Team

8 plugins · 316K total installs

71
trust score
Avg Security Score
89/100
Avg Patch Time
844 days
View full developer profile
Detection Fingerprints

How We Detect Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/formidable/css/admin/addons-page.css/wp-content/plugins/formidable/js/addons-page.js
Script Paths
/wp-content/plugins/formidable/js/addons-page.js
Version Parameters
/wp-content/plugins/formidable/css/admin/addons-page.css?ver=/wp-content/plugins/formidable/js/addons-page.js?ver=

HTML / DOM Fingerprints

CSS Classes
frm-upgrade-submenu
HTML Comments
<!-- Formidable Forms -->
Data Attributes
data-formiddata-fieldid
JS Globals
frmFormfrmFieldfrmGlobal
REST Endpoints
/wp-json/formidable/v1/settings/wp-json/formidable/v1/forms/wp-json/formidable/v1/entries
Shortcode Output
[formidable id="[formidable slug="
FAQ

Frequently Asked Questions about Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder