WordPress formcraft has 8 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2013-7187 | SQL injection vulnerability in form.php in the FormCraft plugin 1.3.7 and earlier for WordPress allows remote attackers to execute arbitrary | high | 7.5 | <=1.3.7 or =1.1 or =1.2 or =1.2.1 or =1.3 or =1.3.1 or =1.3.2 or =1.3.3 or =1.3.4 or =1.3.5 or =1.3.6 | – |
| CVE-2017-13137 | The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the id parameter to form.php. | critical | 9.8 | =1.0.5 | – |
| CVE-2023-2592 | The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to | high | 7.2 | <3.9.7 | 3.9.7 |
| CVE-2017-18600 | The formcraft3 plugin before 3.4 for WordPress has stored XSS via the "New Form > Heading > Heading Text" field. | medium | 5.4 | <=3.2.31 | – |
| CVE-2022-1647 | The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perfor | medium | 4.8 | <1.2.6 | 1.2.6 |
| CVE-2023-3501 | The FormCraft WordPress plugin before 1.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such a | medium | 4.8 | <1.2.7 | 1.2.7 |
| CVE-2024-13783 | The FormCraft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in formcraft-main.php in a | medium | 4.3 | <3.9.12 | 3.9.12 |
| CVE-2025-0817 | The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3 | high | 7.2 | <3.9.12 | 3.9.12 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden wordpress /var/www/html # or, without Composer pipx install phpwarden && phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked