WS Form LITE – Drag & Drop Contact Form Builder

80 Quality Score

Active Installs

18/30

With roughly 10,000 active installs, WS Form LITE is a niche option that trails the category leaders by two to three orders of magnitude, which keeps its popularity score modest.

Update Freshness

25/25

Last updated July 2026 and tested against WordPress 7.0.1, the plugin shows strong and current maintenance that gives little cause for concern.

User Rating

15/15

A perfect 100 from 317 reviewers is unusually high and suggests either a delighted early adopter base or a self-selecting sample, but there is no negative signal here.

Support Health

8/15

With zero support threads recorded, there is simply no evidence either way, so the neutral 50 score reflects an unknown rather than a proven strength or weakness.

WP Compatibility

15/15

Requiring PHP 7.2 and WordPress 5.5 while being tested on 7.0.1 means the plugin will run on the vast majority of modern WordPress installations.

Scores higher than 81% of indexed plugins

About

Contact form builder for WordPress. Create professional, accessible, mobile-friendly forms in minutes without coding.

Active Installs 10k+

Rating ★★★★★ 5/5

Last Updated 2026-09-09 1:06am GMT

Requires WordPress 5.5+

Tested Up To 7.1

Requires PHP 7.2+

Security History

11 known vulnerabilities, all patched

1 Critical 2 High 8 Medium

Most recent: August 21, 2026

View details ▸

WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission Critical

August 21, 2026 Patched in ["1.10.82"] CVE-2026-4703

WS Form LITE <= 1.11.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Update Medium

July 10, 2026 Patched in ["1.11.8"] CVE-2026-11562

WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.10.35 - Missing Authorization to Unauthenticated Sensitive Information Exposure Medium

April 24, 2025 Patched in ["1.10.36"] CVE-2025-3912

WS Form LITE and PRO <= 1.10.13 - Unauthenticated Stored Cross-Site Scripting High

January 27, 2025 Patched in ["1.10.14"] CVE-2024-13509

WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL Medium

November 5, 2024 Patched in ["1.9.245"] CVE-2024-10647

WS Form LITE <= 1.9.238 - Unauthenticated Stored Cross-Site Scripting Medium

September 25, 2024 Patched in ["1.9.244"] CVE-2024-47320

WS Form LITE <= 1.9.217 - Unauthenticated CSV Injection Medium

June 6, 2024 Patched in ["1.9.218"] CVE-2023-5424

WS Form LITE <= 1.9.170 - Authenticated(Administrator+) SQL Injection Medium

December 28, 2023 Patched in ["1.9.171"] CVE-2023-52135

WS Form LITE <= 1.9.117 - CAPTCHA Bypass Medium

May 23, 2023 Patched in ["1.9.118"]

WS Form LITE and Pro < 1.8.176 - Stored Cross-Site Scripting Medium

January 31, 2022 Patched in ["1.8.176"] CVE-2022-23987

WS Form LITE and WS Form Pro < 1.8.176 - Stored Cross-Site Scripting High

January 31, 2022 Patched in ["1.8.176"] CVE-2022-23988

What It Does

WS Form LITE is a drag and drop contact form builder for WordPress that lets you create accessible, mobile-friendly forms without writing code. It includes field types, conditional logic, and styling controls typically found in premium plugins, delivered in a free package. The LITE edition acts as a gateway to the paid WS Form Pro tier.

Who It's For

This plugin suits site owners, freelancers, and small agencies who want a capable free form builder with accessibility baked in, rather than a stripped-down trial. It fits well on business sites, portfolios, and lead generation pages that need professional looking forms out of the box.

Who Should Skip It

If you only need a basic contact form with no conditional logic or accessibility requirements, lighter options like Contact Form 7 will do the job with less overhead. Sites already running WPForms, Forminator, or Gravity Forms should avoid adding yet another form plugin to the stack.

The Bottom Line

WS Form LITE delivers genuinely impressive ratings and modern compatibility for a small plugin, but its 10,000 installs and zero support activity mean you are betting on a less proven contender than WPForms or Forminator. It is a solid pick if accessibility and a clean interface matter more to you than ecosystem size. Everyone else will find safer defaults among the alternatives listed.

Pick Akismet instead once spam becomes a problem, since it layers anti-spam protection across any form plugin you choose.

WPForms Lite 97/100

Choose WPForms Lite when you want a much larger install base, a polished onboarding flow, and the broadest ecosystem of add-ons.

Forminator Forms 94/100

Pick Forminator when you need built-in polls, quizzes, and payment forms bundled into a single free plugin.

GDPR Cookie Compliance 93/100

Choose a dedicated cookie consent plugin like this one alongside any form builder when GDPR cookie compliance is the actual requirement.

Complianz GDPR/CCPA Cookie Consent

Pick Complianz for deeper, jurisdiction-aware consent management that goes well beyond what any form plugin can offer on its own.