VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 6 known issues Latest disclosed Mar 28, 2022

Caldera Forms – More Than Contact Forms Vulnerabilities

Review known vulnerability records for the WordPress plugin Caldera Forms – More Than Contact Forms (`caldera-forms`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2022-0879, CVE-2021-24896 and CVE-2018-7747, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
6
High or Critical
0
Patch Coverage
100%
Last Updated
Jan 22, 2024
Related Security Guides

Use these guides while reviewing Caldera Forms – More Than Contact Forms fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Caldera Forms – More Than Contact Forms remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
2
1. Match the Package
Confirm the installed WordPress plugin slug is caldera-forms before acting on any CVE from this cluster.
2. Sort by Severity
Start with 0 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
6 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2022-0879 Medium
Cross-Site Scripting remediation for Caldera Forms – More Than Contact Forms

Affected range: Versions before 1.9.7. Fixed version: 1.9.7.

CVE-2018-7747 Medium
Cross-Site Scripting remediation for Caldera Forms – More Than Contact Forms

Affected range: Versions up to 1.5.9.1. Fixed version: 1.6.0.

CVE-2021-24896 Medium
Stored Cross-Site Scripting remediation for Caldera Forms – More Than Contact Forms

Affected range: Versions before 1.9.5. Fixed version: 1.9.5.

Priority CVE Quick Links

Fast paths into Caldera Forms – More Than Contact Forms CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
3
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2022-0879
Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api
 Cross-Site Scripting Versions before 1.9.7 1.9.7 CVSS 6.1
CVE-2018-7747
Caldera Forms <= 1.5.9.1 - Cross Site Scripting
 Cross-Site Scripting Versions up to 1.5.9.1 1.6.0 CVSS 5.5
CVE-2021-24896
Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting
 Stored Cross-Site Scripting Versions before 1.9.5 1.9.5 CVSS 4.8
CVE-2022-0879 Medium 1.9.7
CVE-2022-0879 Caldera Forms – More Than Contact Forms Cross-Site Scripting

Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api

CVE-2018-7747 Medium 1.6.0
CVE-2018-7747 Caldera Forms – More Than Contact Forms Cross-Site Scripting

Caldera Forms <= 1.5.9.1 - Cross Site Scripting

CVE-2021-24896 Medium 1.9.5
CVE-2021-24896 Caldera Forms – More Than Contact Forms Stored Cross-Site Scripting

Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Caldera Forms – More Than Contact Forms so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
6 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 0 high severity findings.
Recent CVEs
CVE-2022-0879, CVE-2021-24896 and CVE-2018-7747
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Caldera Forms – More Than Contact Forms

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2022-0879
CVE-2022-0879: Caldera Forms <= 1.9.6 - Reflected Cross-Site Scripting via cf-api

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting

Published
Mar 28, 2022
Patched Release
1.9.7
Affected Versions
Versions before 1.9.7
Next Step
Update to 1.9.7 or newer if supported.
Review CVE-2022-0879 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-24896
CVE-2021-24896: Caldera forms <= 1.9.4 - Admin+ Stored Cross-Site Scripting

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Published
Nov 11, 2021
Patched Release
1.9.5
Affected Versions
Versions before 1.9.5
Next Step
Update to 1.9.5 or newer if supported.
Review CVE-2021-24896 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2018-7747
CVE-2018-7747: Caldera Forms <= 1.5.9.1 - Cross Site Scripting

Multiple cross-site scripting (XSS) vulnerabilities in the Caldera Forms plugin before 1.6.0-rc.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) a greeting message, (2) the email transaction log, or (3) an imported form.

Published
Apr 20, 2018
Patched Release
1.6.0
Affected Versions
Versions up to 1.5.9.1
Next Step
Update to 1.6.0 or newer if supported.
Review CVE-2018-7747 fixed version details Open CVE Reference
Plugin Medium Patched: Yes
Caldera Forms <= 1.5.4 - Cross-Site Scripting

The Caldera Forms plugin for WordPress is vulnerable to Cross-Site Scripting via the "edit" parameter in versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scr...

Published
Sep 08, 2017
Patched Release
1.5.5
Affected Versions
Versions up to 1.5.4
Next Step
Update to 1.5.5 or newer if supported.
Review Caldera Forms – More Than Contact Forms vulnerability details
Plugin Medium Patched: Yes
Caldera Forms <= 1.4.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Caldera Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CSRF through the ‘create_form’ action in versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

Published
Nov 08, 2016
Patched Release
1.4.2
Affected Versions
Versions up to 1.4.1
Next Step
Update to 1.4.2 or newer if supported.
Review Caldera Forms – More Than Contact Forms vulnerability details
Plugin Medium Patched: Yes
Caldera Forms – More Than Contact Forms < 1.4.0 - Sensitive Information Disclosure

The Caldera Forms – More Than Contact Forms plugin for WordPress is vulnerable to Sensitive Information Disclosure due to missing capability checks on the browse_entries() function that makes it possible for low-level authenticated attackers to retrieve form entries in versions u...

Published
May 24, 2016
Patched Release
1.4.0
Affected Versions
Versions before 1.4.0
Next Step
Update to 1.4.0 or newer if supported.
Review Caldera Forms – More Than Contact Forms vulnerability details