# Advanced Form Integration — Connect Forms to 300+ Apps

> Send WordPress form and order data to 300+ CRMs, email tools, and sheets — no code, no per-task fees, data stays on your site.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 11:31 UTC.

## Facts (WordPress.org)

- Slug: `advanced-form-integration`
- Author: Nasir Ahmed
- Version: 2.11.5
- Active installs: 9,000+
- Last update: 2026-11-10 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 3.0.1, PHP 7.4
- Tags: automation, contact form 7, crm, form integration, webhooks
- Page: https://wordpress.org/plugins/advanced-form-integration/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Flaky ↔ Reliable, Inaccessible ↔ Accessible, Phones home ↔ Private, Paywalled ↔ Generous, Vague docs ↔ Clear docs.

## Known vulnerabilities

- 2026-11-06 HIGH: Unauthenticated PHP Object Injection via $_POST Parameters (up to 2.10.2). CVE-2026-104738, https://www.wordfence.com/threat-intel/vulnerabilities/id/dbea3356-2fc1-4511-9767-e560b7c4f0a8?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member... (up to 2.9.0). CVE-2026-104797, https://www.wordfence.com/threat-intel/vulnerabilities/id/586fd95e-88c7-4eb8-826c-ae46a11ac21f?source=api-prod
- 2026-07-28 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function (up to 2.6.0). CVE-2026-16587, https://www.wordfence.com/threat-intel/vulnerabilities/id/af913bb1-eff6-47cd-9471-f74bafda1e52?source=api-prod
- 2026-07-01 HIGH: Unauthenticated Privilege Escalation (up to 2.1.0). CVE-2026-11794, https://www.wordfence.com/threat-intel/vulnerabilities/id/285cbadb-16cd-4725-a2fb-643bf1b38914?source=api-prod
- 2026-06-15 MEDIUM: Missing Authorization (up to 1.126.12). CVE-2026-42659, https://www.wordfence.com/threat-intel/vulnerabilities/id/2009a0d7-ce42-46b5-986d-33e3d06a513d?source=api-prod
- 2025-03-03 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.99.0). CVE-2024-13123, https://www.wordfence.com/threat-intel/vulnerabilities/id/1b5a6633-4ce3-4249-a5b0-d8f960aae903?source=api-prod
- 2025-03-03 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.99.0). CVE-2024-13122, https://www.wordfence.com/threat-intel/vulnerabilities/id/63a373a5-4284-4de5-93cd-63274b4e739f?source=api-prod
- 2025-01-03 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 1.95.0). CVE-2024-56293, https://www.wordfence.com/threat-intel/vulnerabilities/id/4c64ec9f-c9ca-49c1-9126-b31defb826dd?source=api-prod
- 2024-11-12 MEDIUM: Reflected Cross-Site Scripting (up to 1.92.0). CVE-2024-10877, https://www.wordfence.com/threat-intel/vulnerabilities/id/936de04d-9b80-430b-a8b7-9755b68e2a02?source=api-prod
- 2024-08-16 MEDIUM: Cross-Site Request Forgery (up to 1.89.4). CVE-2024-43340, https://www.wordfence.com/threat-intel/vulnerabilities/id/03354f47-ebf7-4242-89d0-1b937d418c6f?source=api-prod
- 2024-03-19 MEDIUM: SQL Injection to Reflected Cross-Site Scripting via integration_id (up to 1.82.0). CVE-2024-2387, https://www.wordfence.com/threat-intel/vulnerabilities/id/45d5a677-9b8b-4258-9cfb-101b0f0e6f6f?source=api-prod
- 2023-12-21 MEDIUM: Authenticated(Administrator+) SQL Injection (before 1.76.0). CVE-2023-50853, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5782b71-3234-4e53-9b26-225472f604c5?source=api-prod
- 2023-07-18 MEDIUM: Reflected Cross-Site Scripting via fs_request_get (up to 1.69.0). WF-5253fe2b-040b-417c-b257-0cb59ee5aa6e-477, https://www.wordfence.com/threat-intel/vulnerabilities/id/5253fe2b-040b-417c-b257-0cb59ee5aa6e?source=api-prod
- 2023-01-27 MEDIUM: Authenticated (Admin+) Cross Site Scripting (up to 1.62.0). CVE-2022-47173, https://www.wordfence.com/threat-intel/vulnerabilities/id/1e9458e4-570e-4871-84ac-380107037b1c?source=api-prod
- 2022-03-04 MEDIUM: Missing Authorization Checks (before 1.49.0). WF-39fb0499-9ab4-4a2f-b0db-ece86bcf4d42-276, https://www.wordfence.com/threat-intel/vulnerabilities/id/39fb0499-9ab4-4a2f-b0db-ece86bcf4d42?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=advanced-form-integration · HTML: https://todaywp.com/plugins/advanced-form-integration