HTML Forms – Simple WordPress Forms Plugin

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   HTML Forms – Simple WordPress Forms Plugin

Information

Software Type Plugin
Software Slug html-forms (view on wordpress.org)
Software Status Active
Software Author linksoftware
Software Website htmlformsplugin.com
Software Downloads 263,918
Software Active Installs 10,000
Software Record Last Updated July 21, 2026

9 Vulnerabilities

Submit a Vulnerability
HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting
6.1
CVE-2025-13861
Dec 16, 2025
Researcher: Itthidej Aramsri (Boeing777)
HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-12125
Nov 7, 2025
Researcher: Muhammad Nur Ibnu Hubab
HTML Forms <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-46236
Apr 22, 2025
Researcher: Muhammad Yudha - DJ
HTML Forms <= 1.5.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2025-31080
Apr 1, 2025
Researcher: Abhinav Porwal
HTML Forms <= 1.4.1 - Reflected Cross-Site Scripting
6.1
CVE-2024-56060
Dec 18, 2024
Researcher: Peter Thaleikis
HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery
4.3
CVE-2024-6412
Jul 10, 2024
Researcher: Bob Matyas
HTML Forms – Simple WordPress Forms <= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-6243
Jul 1, 2024
Researcher: Majdeddine Ben Hadj Brahim
HTML Forms <= 1.3.28 - Authenticated (Administrator+) Cross-Site Scripting
5.5
CVE-2023-50836
Dec 21, 2023
Researcher: Huynh Tien Si
HTML Forms <= 1.3.24 - Authenticated (Administrator+) SQL Injection
7.2
CVE-2022-3689
Nov 7, 2022
Researcher: Nguyen Duy Quoc Khanh
Title Status CVE ID CVSS Researchers Date
HTML Forms – Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-13861 6.1 Itthidej Aramsri (Boeing777) December 16, 2025
HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2025-12125 4.4 Muhammad Nur Ibnu Hubab November 7, 2025
HTML Forms <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-46236 6.4 Muhammad Yudha - DJ April 22, 2025
HTML Forms <= 1.5.1 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2025-31080 7.2 Abhinav Porwal April 1, 2025
HTML Forms <= 1.4.1 - Reflected Cross-Site Scripting Patched CVE-2024-56060 6.1 Peter Thaleikis December 18, 2024
HTML Forms – Simple WordPress Forms Plugin <= 1.3.33 - Cross-Site Request Forgery Patched CVE-2024-6412 4.3 Bob Matyas July 10, 2024
HTML Forms – Simple WordPress Forms <= 1.3.32 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-6243 4.4 Majdeddine Ben Hadj Brahim July 1, 2024
HTML Forms <= 1.3.28 - Authenticated (Administrator+) Cross-Site Scripting Patched CVE-2023-50836 5.5 Huynh Tien Si December 21, 2023
HTML Forms <= 1.3.24 - Authenticated (Administrator+) SQL Injection Patched CVE-2022-3689 7.2 Nguyen Duy Quoc Khanh November 7, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation