shouldiuse.io

Categories

VERDICT

Should I use WPForms?

World's Leading WordPress AI Form Builder Plugin - wpforms.com

Depends. WPForms is a buy for WordPress owners who want fast, beginner-friendly forms and can start on the free Lite tier. Skip it if you're not on WordPress, need every feature upfront, or won't accept steep renewal prices.

Confidence

High. Based on 20+ public sources: reviews, pricing pages, and CVE databases.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Lite

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Basic~$49.50/yr
Pro$199.50/yr

Best for

  • WordPress beginners
  • Small businesses needing contact forms fast
  • Bloggers and solopreneurs
  • Lead-gen forms on WordPress

Not for

  • Non-WordPress sites — it only runs as a WordPress plugin
  • Anyone needing every feature on day one without Pro pricing
  • Budget buyers burned by renewal-year price hikes
  • Teams needing a clean enterprise security track record

Gotchas - check before you buy

high

Renewal costs jump after year one; calculate the second-year price before committing

high

Several 2025–2026 CVEs including RCE; update the plugin immediately when patches ship

medium

Payments, advanced fields, and most integrations require paid tiers, not Lite

medium

WPForms Lite was publicly accused of adding a 'backdoor' to new installations

Pros and cons

Pros

  • Free Lite tier covers basic WordPress forms
  • Drag-and-drop builder repeatedly praised as beginner-friendly
  • Addons for payments, quizzes, and marketing integrations
  • GDPR and CCPA compliance features built in
  • Strong support reputation across Trustpilot reviews

Cons

  • Key features locked behind Pro tiers; Lite covers basics only
  • Reviewers call it easy to start, expensive to grow into
  • Multiple 2025–2026 CVEs, including RCE and auth bypass
  • Renewal-year pricing costs more than first-year deals
  • Some users hit blocking issues and quit the plugin

Sources & method

Analyzed 10/03/2026 - 11 sources - Actively maintained with published security docs, but multiple 2025–2026 CVEs — including auth bypass and RCE — make prompt updates essential.

official x2review x7security x2
  • CVE-2026-10818 — Pro arbitrary file upload, WPForms Pro flaw allowed arbitrary file upload leading to remote code execution.
  • CVE-2026-32446 — Auth bypass, WPForms authentication bypass vulnerability disclosed March 2026.
  • WPForms < 1.9.9.2 — unauthenticated sensitive data exposure, Unauthenticated sensitive data vulnerability, fixed in 1.9.9.2.
  • WPForms <= 2.0.2 — reflected XSS, Reflected cross-site scripting via page-title POST parameter.
  • CVE-2026-25430 — missing authorization, Missing authorization vulnerability listed on NVD.

Key stats

  • Value for money: 2/5

    Rating

  • Free

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 2/5. Cheap to start; renewals and tier jumps sting
  • Ease of use: 5/5. Widely praised as beginner-friendly drag-and-drop
  • Feature depth: 4/5. Huge addon library, many features Pro-gated
  • Support quality: 4/5. Trustpilot reviews praise customer service
  • Security posture: 2/5. Multiple recent CVEs; patching required
  • 12,507+ User reviews on WPForms' own review page
  • Free Starting price Pro tiers from ~$49.50/yr
  • Yes Free tier WPForms Lite, limited features
  • 2016 Launched per founder's launch announcement

Pricing

Lite

Free

  • Basic contact and feedback forms
  • No premium addons

Basic

~$49.50/yr

  • Entry paid tier
  • Essential features, one site

Pro

$199.50/yr

  • Full addon library
  • Advanced integrations

Security

Actively maintained with published security docs, but multiple 2025–2026 CVEs — including auth bypass and RCE — make prompt updates essential.

  • CVE-2026-10818 — Pro arbitrary file uploadWPForms Pro flaw allowed arbitrary file upload leading to remote code execution.10
  • CVE-2026-32446 — Auth bypassWPForms authentication bypass vulnerability disclosed March 2026.
  • WPForms < 1.9.9.2 — unauthenticated sensitive data exposureUnauthenticated sensitive data vulnerability, fixed in 1.9.9.2.11
  • WPForms <= 2.0.2 — reflected XSSReflected cross-site scripting via page-title POST parameter.
  • CVE-2026-25430 — missing authorizationMissing authorization vulnerability listed on NVD.

What users say

Most users love the drag-and-drop simplicity and support, while recurring complaints target renewal pricing and tier limits.

“It took me far too long to realize WPForms is worth the money.”
Reddit, r/Wordpress
“WPForms is killing me”
Reddit, r/Wordpress
“WPForms has 5 stars!”
Trustpilot
Full analysis

Based on 20+ public sources: reviews, pricing pages, and CVE databases.

Beginner-friendly WordPress forms with a free tier — but Pro pricing, renewals climb fast and recent CVEs need quick patches.

Methodology

Based on 20+ public sources: reviews, pricing pages, and CVE databases.

Sources

  1. WPForms Customer Reviews — Trustpilottrustpilot.com
    review
  2. WPForms Reviews — G2g2.com
    review
  3. It took me far too long to realize WPForms is worth the money — Redditreddit.com
    review
  4. WPForms is killing me — Redditreddit.com
    review
  5. WPForms Review: Easy to Start, Expensive to Grow Intofatlabwebsupport.com
    review
  6. WPForms Alternatives: What Renewal Year Really Costsivyforms.com
    review
  7. In-Depth WPForms Review — WPBeginnerwpbeginner.com
    review
  8. WPForms Pricing and Planswpforms.com
    official
  9. WPForms homepagewpforms.com
    official
  10. CVE-2026-10818 — WPForms Pro RCE (Cycognito)cycognito.com
    security
  11. WPForms < 1.9.9.2 vulnerability (WPScan)wpscan.com
    security

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.