Is Visual Form Builder safe?

Every recorded flaw

• Oct 16, 2026Visual Form Builder: Does not perform an authorization check before displaying recent form submission data in a dashboard widgetCVE-2026-105974 · affects up to 3.1 · reported by WPScanMedium 4.3
• Oct 16, 2026Visual Form Builder: Does not perform authorization or nonce checksCVE-2026-105973 · affects up to 3.1 · reported by WPScanMedium 4.3
• May 2, 2022Visual Form Builder: Does not sanitise and escape the form's 'Email to' fieldCVE-2022-1046 · fixed in 3.0.7 · reported by WPScanMedium 4.8
• Apr 12, 2022Visual Form Builder: Is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV fileCVE-2022-0142 · fixed in 3.0.8 · reported by WPScan2.9% oddsCritical 9.8
• Apr 12, 2022Visual Form Builder: Does not enforce nonce checksCVE-2022-0141 · fixed in 3.0.8 · reported by WPScanHigh 8.1
• Apr 12, 2022Visual Form Builder: Does not perform access control on entry form exportCVE-2022-0140 · fixed in 3.0.6 · reported by WPScan3.8% oddsMedium 5.3
• Oct 25, 2021Visual Form Builder: Does not sanitise or escape its Form NameCVE-2021-24514 · fixed in 3.0.4 · reported by WPScanMedium 4.8

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.