WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress

The most powerful and user-friendly WordPress contact form plugin. Create beautiful contact forms, widgets and pages using shortcodes.

9Reported vulnerabilities
6.4Highest CVSS score
4.3.9Latest version
30,000+Active installs

What to do now

Update Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress to 4.3.7 or later. 9 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 16, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2017-18491 Medium 6.1 1.5% Before 4.0.6 4.0.6 August 13, 2019
CVE-2013-7481 Medium 6.1 0.9% Before 3.3.5 3.3.5 August 22, 2019
CVE-2016-10869 Medium 6.1 0.9% Before 4.0.2 4.0.2 August 13, 2019
CVE-2015-9295 Medium 6.1 0.9% Before 3.96 3.96 August 13, 2019
CVE-2013-7475 Medium 6.1 0.9% Before 3.52 3.52 August 13, 2019
WF-274e5568-b600-4085-8406-9f9d5d4fc35a Medium 6.4 — 3.82 and earlier 3.83 January 22, 2015
CVE-2024-2200 Medium 6.1 0.5% Before 4.2.9 4.2.9 April 9, 2024
CVE-2024-2198 Medium 6.1 0.5% 0 to 4.2.8 (inclusive) 4.2.9 April 9, 2024
CVE-2025-63056 Medium 4.3 0.3% 4.3.6 and earlier 4.3.7 December 7, 2025

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.