SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz

87 Quality Score

Active Installs

26/30

With 500,000 active installs the plugin is well established, though it sits well behind category leaders like Contact Form 7 at 10 million and WPForms Lite at 5 million.

Update Freshness

25/25

Updated as recently as July 2026 and tested against WordPress 7.0.1, the maintenance signal is excellent and suggests an actively maintained codebase.

User Rating

14/15

A 98 out of 100 from 80 ratings is a very strong score, though the relatively small rating pool means the average may shift as more users weigh in.

Support Health

8/15

Only 3 support threads exist in the dataset, all resolved, which is positive on resolution rate but the tiny volume makes it hard to draw strong conclusions about ongoing support health.

WP Compatibility

15/15

Tested with WordPress 7.0.1, requiring WordPress 6.4 and PHP 7.4, so compatibility is broad and works on most modern hosting setups.

Scores higher than 98% of indexed plugins

About

AI form generator and WordPress form builder for contact and Stripe payment forms, with surveys and quizzes in SureForms Business.

Active Installs 500k+

Rating ★★★★½ 4.8/5

Last Updated 2026-09-25 9:26am GMT

Requires WordPress 6.4+

Tested Up To 7.1.2

Requires PHP 7.4+

Security History

20 known vulnerabilities, all patched

6 High 14 Medium

Most recent: September 4, 2026

View details ▸

SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload High

September 4, 2026 Patched in ["2.12.3"] CVE-2026-18406

SureForms – Contact Form Builder, AI Forms, Payment Form, Survey & Quiz <= 2.12.5 - Unauthenticated Insecure Direct Object Reference Medium

September 3, 2026 Patched in ["2.12.6"] CVE-2026-85308

SureForms <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'headingWrapper' Block Attribute Medium

July 31, 2026 Patched in ["2.8.2"] CVE-2026-7623

SureForms <= 2.11.0 - Unauthenticated Payment Amount Bypass Medium

June 23, 2026 Patched in ["2.11.1"] CVE-2026-11567

SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id' High

March 27, 2026 Patched in ["2.6.0"] CVE-2026-4987

SureForms <= 2.2.1 - Missing Authorization Medium

February 15, 2026 Patched in ["2.2.2"]

SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation High

February 13, 2026 Patched in ["2.2.2"] CVE-2026-15288

SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting High

December 20, 2025 Patched in ["2.2.1"] CVE-2025-14855

SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution Medium

November 18, 2025 Patched in ["1.13.2"] CVE-2025-12535

SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure Medium

November 12, 2025 Patched in ["1.13.2"] CVE-2025-12536

SureForms – Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure Medium

October 13, 2025 Patched in ["1.12.2"] CVE-2025-10732

SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation Medium

September 19, 2025 Patched in ["1.12.1"] CVE-2025-10489

SureForms – Drag and Drop Form Builder for WordPress <= 1.9.0 - Authenticated (Admin+) Stored Cross-Site Scripting Medium

September 2, 2025 Patched in ["1.9.1"] CVE-2025-8282

SureForms <= 1.7.1 - Reflected Cross-Site Scripting Medium

July 11, 2025 Patched in ["1.7.2"] CVE-2025-5921

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion High

July 8, 2025 Patched in ["0.0.14","1.0.7","1.1.2","1.2.5","1.3.2","1.4.5","1.5.1","1.6.5","1.7.4"] CVE-2025-6691

SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion High

July 8, 2025 Patched in ["0.0.14","1.0.7","1.1.2","1.2.5","1.3.2","1.4.5","1.5.1","1.6.5","1.7.4"] CVE-2025-6742

SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

April 11, 2025 Patched in ["1.4.4"] CVE-2025-3513

SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting Medium

April 11, 2025 Patched in ["1.4.4"] CVE-2025-3514

SureForms – Drag and Drop Form Builder for WordPress <= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Settings Update Medium

April 9, 2025 Patched in ["1.4.4"] CVE-2025-3471

SureForms – Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure Medium

January 7, 2025 Patched in ["1.2.3"] CVE-2024-12713

What It Does

SureForms is a drag and drop form builder that lets WordPress users create contact forms, payment forms, surveys, quizzes, and multi-step forms without writing code. It includes AI-assisted features to speed up form creation and supports a range of input types beyond a basic contact form. The plugin is developed by Brainstorm Force, the team behind the Astra theme.

Who It's For

This plugin is a good fit for site owners running Astra or other Brainstorm Force products who want a single bundled form solution rather than juggling a separate plugin. It also suits small business owners and freelancers who need payment forms, surveys, and quizzes in one tool without code. If you value a polished UI and clean admin experience over deep extensibility, SureForms fits.

Who Should Skip It

Developers and agencies needing advanced conditional logic, deep third-party integrations, or a large ecosystem of add-ons will find SureForms limiting compared to WPForms or Fluent Forms. Sites already standardized on Forminator, Gravity Forms, or Contact Form 7 have little reason to migrate.

The Bottom Line

SureForms earns an overall quality score of 87.72 out of 100, with standout maintenance and rating scores and a respectable install base of 500,000 sites. It is a capable, well-maintained builder, but it is not yet a category leader, and users with complex form needs may outgrow it. For Astra-based sites needing an all-in-one form, survey, and payment solution, it is a sensible pick.

Related Plugins

Akismet Anti-spam 99/100

Pick Akismet only if your sole need is comment and submission spam filtering rather than building forms.

WPForms Lite 97/100

Choose WPForms when you want a larger user community, more third-party add-ons, and a deeper template library.

Forminator Forms 94/100

Pick Forminator if you want built-in polls, quizzes, and calculations without paying for a premium tier.

Fluent Forms 88/100

Choose Fluent Forms for stronger free-tier features, advanced conditional logic, and a wider integration ecosystem.

Contact Form 7 88/100

Pick Contact Form 7 if you want maximum simplicity, maximum install base, and are comfortable with shortcode-based forms.