How many vulnerabilities does SubtleForms have?

The audit found 133 findings: 0 critical, 19 high, 63 medium severity.

Should I use SubtleForms?

Based on the latest audit (grade D, risk HIGH), review the 133 findings on this page before deciding — higher-risk findings should be weighed against the plugin's alternatives.

SubtleForms

Q: Is SubtleForms secure?

WP HealthKit's independent audit rates SubtleForms overall risk as HIGH with a report-card grade of D.

Audited at release

v2.7.3WordPress PluginAudited Today

Build contact, multi-step and conversational forms on a visual canvas, then read every entry in a clean inbox. Spam protection built in.

HIGH

Total Findings

133

Security Grade

Coding Score

83/100

Security Findings

133

Critical0

High19

Medium63

Low41

Info10

Executive Summary

Is SubtleForms secure? In WP HealthKit's independent 2026 audit, SubtleForms received an overall risk of HIGH and a report-card grade of D across 133 findings (0 critical, 19 high severity).

Directory audit — deterministic scanners only (Wordfence, OSV, PHPCS, PHPStan, Semgrep, Psalm, compat). Sign in and run a full audit for AI-grade analysis (security, quality, accessibility).

Security Report Card

Readiness

Coding Standards

83/100

PHP Compatibility

Requires PHP 8.1Declared minimum: 8.1

Categories with Findings

Hardcoded SecretsPerformanceDatabasePlugin LifecycleCoding StandardsSQL InjectionDependency SecurityPlugin ConflictsInternationalizationSecurityTheme StandardsAI-Generated CodeFile SecurityPHP CompatibilityWordPress Compatibilitycompatibility

Plugin Info

Audit Count: 1
Type: plugin

Embed

Show your audit status in your README or website.

[![SubtleForms security audit by WP HealthKit](https://wphealthkit.com/api/badge/by-slug/subtleforms)](https://wphealthkit.com/directory/subtleforms)

Paste this in your GitHub README or any Markdown file. The badge updates automatically on every re-audit — no need to refresh the snippet.

Site owners: should they update?

Are you the developer?

Claim this listing to get a Verified badge, control public audits, and get automatic re-scans.

Claim This Plugin

Readiness

Coding Standards

83/100

PHP Compatibility

Requires PHP 8.1Declared minimum: 8.1

SubtleForms

Security Findings

Executive Summary

Security Report Card

Readiness

PHP Compatibility

Categories with Findings

Plugin Info

Embed

Are you the developer?

Audit Your Plugin

Readiness

PHP Compatibility

Categories with Findings