Form Block WordPress Plugin

Name: Form Block
Availability: InStock
Rating: 5 (4 reviews)
Author: epiphyt

Form Block

Form Block is a WordPress plugin with the following stats:

#2,392 Global Rank

200+ active installs

5/5 4 ratings

Since 2023 3 years active

Vulnerabilities

2 Total

2 Patched

0 Active

100% Resolved rate

Form Block <= 1.5.5 - Unauthenticated Arbitrary File Upload

CWE-434 · Unrestricted Upload of File with Dangerous Type

The Form Block plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the files() function in all versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

9.8 Critical Affected All – 1.5.5 Patched in ✓ 1.5.6 Published 7 Aug 2025 CVE CVE-2025-54693

Form Block <= 1.0.1 - Cross-Site Request Forgery

CWE-352 · Cross-Site Request Forgery (CSRF)

The Form Block plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the get_requests() function. This makes it possible for unauthenticated attackers to submit forms on behalf of another user via a forged request granted they can trick a user into performing an action such as clicking on a link.

4.3 Medium Affected All – 1.0.2 Patched in ✓ 1.0.2 Published 20 Apr 2023 CVE CVE-2023-30616

About Form Block

An extensive yet user-friendly form block.

WordPress offers several (contact) form plugins, but most of them are not up-to-date anymore when it comes to creating forms. Form Block tackles this problem by utilizing the block editor’s power. It enables you to create a form effortlessly within the block editor itself, which makes the process of creating a form much more enjoyable and similar to creating other types of blocks. This innovative approach to form creation ensures that Form Block stands out from other WordPress form plugins.

Note: This plugins requires the PHP extension “Document Object Model” (php-dom).

Features

Fully support of the block editor
Built with accessibility in mind
Create forms with an unlimited number of fields
Select from a wide variety of field types
Use a predefined form or start from scratch
Store form submissions in the WordPress backend
Integrated honeypot for spam protection
Integrated knowledge base for field types
Client-side and server-side validation

Getting started

Add the “Form Block” block anywhere you want to enable a form in your block editor.
Select a predefined form or start from scratch.
Add/Edit/Remove fields to your form as you like. You can select from input, select and textarea fields.

After submission, the form data will be sent to the email address you have set in the settings.

Coming soon

There is much more planned for Form Block. Here is a small selection of features that are coming soon:

Antispam Bee integration
Custom date picker
More customization options

Pro version

There is also a Pro version of Form Block available. It offers additional features, such as:

Extended server-side validation
Custom recipient(s) for each form
Custom form action
Upload via drag and drop
Field dependencies
Multi-step forms with sections
Advanced functionality for accessibility

You can find more information at https://formblock.pro/en/.

Contribution

Feel free to contribute. The code is available at GitHub.

Documentation

You can find the documentation for Form Block at docs.epiph.yt.

Screenshots

The form in the frontend

The form block variation picker

The form creation wizard to create form fields without them creating manually

The form block in the backend

The form block settings

Frequently Asked Questions

Where can I find the settings?

The settings can be found in Settings > Writing > Form Block.

Where will submitted forms be sent to?

All submitted forms will be sent to the administration email address you have set in the settings (Settings > General > Administration Email Address).

If you want to use another email address as recipient, you can use the filter form_block_recipients to change the recipient email address.

Is there a Pro version?

Yes, there is a Pro version with enhanced functionality. Lean more at https://formblock.pro/en/.

How can I contribute?

The code is open source and hosted on GitHub. Read the contributing guide for detailed information.

Who are you, folks?

We are Epiphyt, your friendly neighborhood WordPress plugin shop from southern Germany.

How can I report security bugs?

You can report security bugs through the Patchstack Vulnerability Disclosure Program. The Patchstack team help validate, triage and handle any security vulnerabilities. Report a security vulnerability.

Changelog

1.8.0

Added: Time-based honeypot to reject spam submissions that are sent implausibly fast or that match common bot timing patterns (can be disabled in the settings)
Added: Flood control to only allow one request every X seconds (default: 30 seconds)
Added: Allow sorting select options
Added: Notice if a form has no/too many “reply-to” email input fields
Added: Download of files now require the same capability as viewing submissions
Added: Unit tests
Fixed: Announcing form errors to screen readers
Fixed: Validation if not every input for date with separate fields is filled
Fixed: Focus on date with separate fields if it’s the only invalid field
Fixed: Potentially broken textarea blocks in the editor
Fixed: Many smaller bugs

1.7.3

Fixed: Visibility of checkboxes/radio buttons in the editor in WordPress 7.0
Fixed: Visibility of hidden input field in the editor
Fixed: Output of hidden fields

1.7.2

Fixed: Getting name by label is more reliable
Fixed: Output of checkboxes/radio buttons with custom values

1.7.1

Fixed: Attachments were missing from emails (but still available through the form submissions in the backend)

1.7.0

Added: Support for block variations for inputs and block transforms for all types of form fields
Added: Support for global form styles
Added: Support for border, color and shadow styles for form fields
Added: Support for literal 0 as field value
Fixed: A form block without form fields is now completely hidden in the frontend, as it does not work without any field
Developer: New actions/filters before/after a form submission is created

1.6.1

Fixed: Deleting form submissions manually

1.6.0

Added: Form submissions can now be stored in the WordPress backend in Tools > Form Submissions
Added: Support for columns, rows and the wrap attribute in textareas
Added: Indicator if label has a different value than the name of the field
Improved: Registering blocks is now faster
Improved: Settings are now in a dedicated page in Settings > Form Block
Fixed: Clicking on a file input in the backend does no more open the system’s file selection dialog
Fixed: Re-added missing autocomplete attribute setting
Fixed: Error if no label is defined

1.5.6

Fixed: Validating uploaded files against the file type they claim to be (CVE-2025-54693)

1.5.5

Fixed: A cleared name value of a field now properly uses the auto-generated one to properly check for its value on form submissions

1.5.4

Fixed: Displaying the value of a select option in the backend if no label is defined

1.5.3

Fixed: Broken blocks after inserting them into the editor

1.5.2

Added: Design for Twenty Twenty-Five
Added: Support for new features in Form Block Pro 1.3
Fixed: Broken textarea after saving
Fixed: Various non-critical React-related issues

1.5.1

Fixed: Support for PHP 7.4

1.5.0

Added: Support for input groups based on HTML fieldset element
Added: Support for lists in the output
Added: Support for adding a form label
Added: Support for autocomplete attribute
Added: Support for the spellcheck attribute
Removed: Default added consent checkbox (since it’s not legally required)

1.4.2

Fixed: Validation issues for separated date fields
Fixed: Line breaks in labels are no more removed in the email
Fixed: Error text for a field too large to upload does not indicate anymore that it has been uploaded

1.4.1

Improved: The notice for required fields is now above the form for enhanced accessibility
Fixed: Gaps in certain browsers from hidden input fields
Fixed: The value of hidden input fields is now populated in the frontend
Fixed: Options without a label now correctly show the value in the select
Fixed: Potential PHP warning for split date and time fields

1.4.0

Added: Custom separated date fields (read the announcement for more information)
Added: All supported input types that were previously only part of the Pro version
Added: Design for Twenty Twenty-Four
Added: More recognized field names for the form wizard
Improved: Input type selection is now more descriptive and translatable
Fixed: aria-describedby for error fields is no more added multiple times
Fixed: Form wizard now returns the proper input fields

1.3.0

Added: Support block settings like font size, line height and dimensions
Added: By selecting an invalid field, the error message will now be announced to screen readers
Fixed: Improved resetting a form after successful submit
Notice: This version requires at least WordPress 6.3
For developers: Each <form> element has now its validator object attached to it

1.2.0

Added: Form creation wizard for even easier form creation
Added: Ability to set a custom subject for each form
Added: Error message summary if multiple form fields are invalid for screen readers
Added: Checks to prohibit multiple form submissions while clicking multiple times on the submit button
Added: Check for PHP DOM extension
Added: A new filter to add custom controls in the primary panel of the form block
Added: A new class for the notice below the field stating how required fields are marked for easier customization
Fixed: After re-validating an invalid form, it can now be sent successfully
Fixed: Line breaks for checkbox labels in Twenty Twenty-Three

1.1.4

Fixed: Sending potentially the wrong checkbox/radio button value if multiple fields have the same name. There is now a new “value” field available for these input types. Please review your forms and adjust the value for your inputs to fix this issue.

1.1.3

Fixed: Invalid fields are now marked via aria-invalid for better accessibility
Fixed: Added aria-hidden="true" to the asterisk, marking a field as required, for better accessibility

1.1.2

Fixed: Issue storing form data for forms when they are in another block (e.g. in a column)

1.1.1

Fixed: Design issue with labels of checkboxes and radio buttons

1.1.0

Added: Rich text editor for labels
Added: Option to set an email field as “reply-to” in the email notification
Added: Preparation to fully support Form Block Pro version 1.0.0
Improved: Displaying of values from checkboxes and radio buttons
Improved: Design of reset and submit buttons (thanks @zu for reporting)
Fixed: Getting correct values for form field name attributes

1.0.2

Fixed: Security issue regarding an CSRF (thanks @DanielRuf for reporting)
Fixed: Changing value of reset/submit buttons is not possible (thanks @zu for reporting)
Fixed: Allowing multiple radio buttons with identical name
Fixed: Submitting an empty form with required fields shows the loading indicator