cformsII – WordPress plugin | WordPress.org

cformsII – WordPress plugin | WordPress.org
Skip to content
Plugin Directory
cformsII
Details
Reviews
Installation
Development
Support
Description
This is a fork of cformsII, a highly customizable, flexible and powerful form builder plugin, covering a variety of use cases and features.
If you want to use plugin versions older than 14.6.3, you should rename the directory containing the plugin from “cforms2” to “cforms”. But bear in mind that old versions should not be used in public systems, because they contain
known serious vulnerabilities
that are exploited in the wild.
The
current security baseline version
is 15.1.4.
Related Plugins
Really Simple CAPTCHA for cformsII
provides an image CAPTCHA via cformsII’s pluggable CAPTCHA facility. To convert the old CAPTCHA fields to Really Simple CAPTCHA, please install the current version and activate the plugin.
Contact Form DB
has support for storing and exporting cformsII’s submission data. Be sure to enable CFDB’s capture submission support for cformsII.
Old Tracking DB for cformsII
is for those who do not want to switch from the built-in Tracking DB to CFDB. However it does not have any web interface.
ReCaptcha Integration for WordPress
provides a reCAPTCHA implementation for cformsII.
Localization
You can see the available languages and contribute via
GlotPress
. Only some of them that are almost completely translated are installed automatically.
If you want to install another language, please choose its cell in the Development column, export it as Machine Object Message Catalog (.mo) and put it in the wp-content/languages/plugins directory.
Installation
Installing the plugin
You can install the plugin via WordPress Dashboard. It should show up by searching for cforms2. If this does not work for you, there should be an option to upload a zip file, which is available on the
wordpress.org plugin directory
If you want to install manually, please upload the complete plugin folder “cforms2”, contained in the zip file, to your WordPress plugin directory!
Upgrading the plugin
If you want to upgrade from the original cformsII from deliciousdays.com, please upgrade to
version 14.6.0.5
first, make sure you upgraded your settings (resave your global settings and every form) and
backup your database
. Then deactivate the original plugin. If you want to migrate your tracking database to CFDB, please install version 14.14 and migrate it. Then you can install the current version of this fork.
The form inclusion does not work with HTML comments (

) anymore. You have to use shortcodes [cforms name=”…”] now. Please change the form calls accordingly.
If you want to delete the 14.6.0.5 version by deleting directory “cforms” and you have any cforms-uploaded files, make sure you do not delete your attachments directory, which is contained in the cforms directory by default.
Custom theme (CSS) files
Create a folder in your WordPress plugins directory and call it “cforms-custom”. Move all your custom theme files into it. This folder will protect your changes going forward.
Check out the
cforms CSS Guide
on layout customization.
FAQ
Why do I not get any emails from my form?
Most probably this is not cformsII’s fault. Please check your WordPress mail configuration with a plugin like
Check Email
. If that reports not to work, you don’t have a mail server running or its settings are broken. Please fix it yourself, tell your hosting provider or use an external SMTP plugin (see the next question).
Where are the external SMTP settings?
That function was removed. The WordPress function
wp_mail
is used for mails now, which makes use of built-in PHPMailer by default. If you want to configure it to use an external SMTP server, use an appropriate plugin, e.g.
WP Mail SMTP
Why is the Form Settings page broken?
This is an incompatibility with WordPress 4.2+ that was fixed with cformsII 14.9.3. Be sure to use a current version.
Where are comment and Tell-a-Friend fields?
These features were removed with version 14.12.
Where is my database view?
This feature was removed with version 15.0.
Does cformsII expose an API?
cformsII can be extended via WordPress actions and filters. You find their ‘cforms2_’ prefixed names and inline documentation at the apply_filters and do_action calls. Additionally there is one API function that you can call directly: insert_cform. Please have a look at its PHPDoc. Older cformsII versions had an API called my-functions, but that is removed as of version 14.14.
Reviews
Although a lot of features had to be removed, this still is a great and easy to use form-plugin. Thank you for keeping it alive!
Hi! This is the most customizable and quick form plugin ever! Great thanks to its authors and developers! Additional gratitude for quick support! Wish all the best! I’m sure it is unfairly low number of installations, that must be millions!
New versions are worst. For first – can’t restore to txt and load in other project. Why?? Old version (Cform) could do it. Second – troubles with sending emails. Old version could include SMTP data, now need third-part plugin. Third – troubles with captcha. New version need third-part plugin.

Then problems in generating html, now option “select” generate to frontend classical “select” (display:none) and (i don’t know why) active ul-li structure…
I’m really crazy about it.
I use CF7 as well, but I like the way cForms II is built.
It is very good and easy to use. Thanks you for all the energy you put into Cforms2.
Folks, this plugin does in an amazing and comprehensive way what other plugins hardly do, and it’s free.

Power to the people!

Seriously, incredible, well built.
Read all 21 reviews
Contributors & Developers
“cformsII” is open source software. The following people have contributed to this plugin.
Contributors
bgermann
cbacchini
codifex
Németh Balázs
Fee
Arslan Kalwar
“cformsII” has been translated into 6 locales. Thank you to
the translators
for their contributions.
Translate “cformsII” into your language.
Interested in development?
Browse the code
, check out the
SVN repository
, or subscribe to the
development log
by
RSS
Changelog
15.1.4
bugfix: Fix XSS in hidden field
bugfix: cforms2_delete_db_and_deactivate: Check nonce to prevent CSRF
15.1.3
bugfix: Add wp_mail_charset filter to work around empty charset
15.1.2
bugfix: Construct multipart/alternative emails
15.1.1
bugfix: Use wp_timezone_string over get_option once again
15.1
bugfix: get rid of wp_mail workaround
15.0.10
bugfix: Use wp_timezone_string over get_option
15.0.9
enhanced: register Fieldtypes on init (PHP 8.4 warnings)
bugfix: fix start date and end date
15.0.8
bugfix: remove unnecessary span elements from HTML attribute values
15.0.7
bugfix: prevent XSS by escaping output: CVE-2023-52203 and CVE-2024-22149
15.0.6
other: (unpublished)
15.0.5
bugfix: Fix CSRF by introducing nonces to admin forms (CVE-2023-25449)
15.0.4
enhanced: make session extension optional
other: remove cookie-based content hiding
other: remove custom email line ending
15.0.3
bugfix: validate q&a field hint id
15.0.2
bugfix: validate {IP} being an IP address, preventing CSRF or other similar attacks
other: remove {Referer} substitution variable
15.0.1
enhanced: remove deprecated html5datetime field type
bugfix: write html5 attributes to field name (long-standing since 14.12.2)
15.0
enhanced: use HTML5 date field on Form Settings page for the start and end dates
enhanced: move style settings to Global Settings
bugfix: do not behave differently for 0 as for any other default value
bugfix: compatibility with PCRE2 evaluating regex character classes differently
other: remove tracking database and its view
other: remove track_cforms capability
other: remove confirmation email attachment
other: remove JavaScript date picker
other: remove all deprecated features and warnings about their usage
other: remove debugging cruft
14.14
enhanced: deprecate insert_custom_cform in favour of insert_cform
enhanced: for consistency, run JavaScript also for non-AJAX forms
enhanced: enable more than one CC me email addresses
enhanced: remove extra email and tracking elimination setting for multipart forms
bugfix: do not mark all fields invalid if just one field is invalid for non-AJAX forms
bugfix: reset multipart forms on every first form
bugfix: checkboxes do not use right label if defined
added: feature to copy old submission data to CFDB
added: WordPress filters cforms2_admin_email_filter, cforms2_cc_me_email_filter, cforms2_auto_conf_email_filter, cforms2_usermessage_filter
other: remove persistent file storage (please use CFDB)
other: remove 3rd party read-notification support
other: remove submission limit feature
other: remove Global Settings for Tracking DB
other: remove Tracking ID for files and {ID} variable
other: remove deprecated HTML comment placeholder
other: remove deprecated API functions my_cforms_logic, my_cforms_filter and my_cforms_ajax_filter
other: remove image CAPTCHA settings
14.13.3
bugfix: fix some verified and some possible authenticated XSS vulnerabilities
bugfix: only redirect non-ajax forms for validated forms
bugfix: wrong condition for error on auto confirmation message
14.13.2
bugfix: fix fatal error caused by using empty() on a function return with PHP < 5.5
14.13.1
bugfix: wrong parentheses
14.13
bugfix: fix authenticated SQL injections in the tracking DB GUI by removing “Delete Entries” and “Download Entries” features and filtering user input
bugfix: do not attach the upload directory to auto confirmation mails
added: hook wp_mail_failed action to give warnings with PHPMailer error details
added: cforms2FormSent JavaScript event on successful form submission
other: remove restore feature and with it jqModal dependency
other: remove tracking DB GUI’s search
other: remove Dashboard widget
other: remove the remaining translation files
other: remove the form presets
other: remove wide_brown_light theme
other: remove deprecated my_cforms_logic callers: redirection, successMessage, ReplyTo, adminTO, adminEmailSUBJ, autoConfSUBJ, fileDestination and fileDestinationTrackingPage
14.12.3
bugfix: repair wrong cforms2_fieldtype_multi_id construction
14.12.2
bugfix: reorganize session reset
enhanced: replace jqModal with jquery-ui-dialog in some dialogs
other: remove fancy-dark theme
14.12.1
bugfix: use right number of fields on dynamic forms
bugfix: really change my_cforms_ajax_filter() API function’s data structure to the same as my_cforms_filter (as logged for 14.11)
enhanced: always set fancy error messages, label IDs and element IDs
enhanced: do not force MyISAM as database engine for the cformsII tables
enhanced: use default character set for the cformsII tables to enable utf8mb4 if available
enhanced: make debug output editable
other: remove “Jump to Error”
other: remove backup in weird NUL offset format
14.12
enhanced: make all date picker options configurable (breaks old datepicker settings)
enhanced: remove role capabilities on uninstall
other: remove RSS support
other: remove Tell-a-Friend support
other: remove WordPress comment support
14.11.4
bugfix: correct AJAX nonce for submitcform action
14.11.3
bugfix: make the AJAX WordPress comment work again (bug was introduced with 14.11)
bugfix: remove the “Select: Email/Comment” field type, also known as send2author, which contained a bug since 14.6.3
bugfix: remove the “Extra comment notification” field type, also known as commentXnote, which contained a bug since 14.6.3
bugfix: also add roles if network activated in multisite
enhanced: remove extra comment success message
other: replace AJAX WordPress comment forms by non-AJAX ones
other: do not save comment form submissions in tracking database anymore
14.11.2
bugfix: AJAX forms are saved in tracking database again
14.11.1
bugfix: make the cforms2_after_processing_action parameter contain file information not dependent on form configuration
bugfix: only show tinymce button when in admin
14.11
enhanced: unify AJAX and non-AJAX processing
enhanced: pluggable captcha API change
enhanced: it is possible now to show more than one form with Q&A on one site
bugfix: make Q&A check work again in AJAX mode
bugfix: prevent using fake CAPTCHAs and Q&As and do not depend on MD5
other: my_cforms_ajax_filter() API function’s data structure changed to the same as my_cforms_filter
other: remove CAPTCHA feature in favour of Really Simple CAPTCHA for cformsII
other: remove Portuguese (Brazil) translation after migration to translate.wordpress.org
other: deprecate my-functions API
14.10.1
bugfix: fix tracking form download url
enhanced: change gettext domain from cforms to cforms2 in cforms-options.php
14.10
other: remove French, German, Italian, Russian and Ukrainian translations after migration to translate.wordpress.org
14.9.13
other: change gettext domain from cforms to cforms2
14.9.12
bugfix: load dashicons if not in dashboard
14.9.11
enhanced: change CAPTCHA reset button
enhanced: remove the old static jQuery UI theme and get current from Google Hosted Libraries
added: possibility to change the jQuery UI theme
other: remove dark-rounded theme
14.9.10
enhanced: replace some icons with Dashicons
enhanced: bump up jqModal to the newest version
other: replace jqDnR with jquery-ui-draggable
other: remove jQuery TextAreaResizer plugin as this is default browser behaviour with CSS 3
other: remove possibility to overwrite tracking fields
14.9.9
bugfix: do not depend on TLD consisting of only 2-4 characters, even on non-AJAX forms
bugfix: do not reset multipage form on back button
enhanced: remove old picture in help section
14.9.8
bugfix: no duplicate form rendering
14.9.7
bugfix: cforms2_make_time: do not depend on timezone being a region
bugfix: do not depend on TLD consisting of only 2-4 characters
bugfix: undo problematic change from 14.9.6
other: remove possibility to show JavaScript alert messages
14.9.6
enhanced: make PHP 5.2 compatible again (in 14.9.4 one 5.3 function was introduced)
enhanced: on style settings do not include ../.. in request parameters to not cause a false positive in application firewalls
other: always show HTML5 field types in form settings
14.9.5
bugfix: circumvent fatal error on wrong form date settings
14.9.4
bugfix: remove warning message after form submission
bugfix: set static datepicker format on forms options page
other: remove ClockPick
14.9.3
bugfix: settings are not removed anymore on plugin activation
bugfix: make HTML5 checkbox have the right status (global settings)
bugfix: do not depend on slash in request string to check for admin page (WordPress 4.2 incompatibility)
14.9.2
bugfix: eliminate scattered > and missing labels
bugfix: fix corrupt settings page path
14.9.1
enhanced: convert Q&A feature to the new pluggable captcha API
added: pluggable captcha API
14.9
enhanced: change the my-functions API to be an extra plugin
bugfix: Shortcode puts the form to the right place
bugfix: missing import in cforms-options.php
other: remove basic style editor
14.8.2
enhanced: elimination of notices in debug mode
enhanced: better mail handling
added: introduce WP_DEBUG_CFORMS2 constant for debug messages
added: check for upload_max_filesize
bugfix: Content-Transfer-Encoding and Content-Type separation
other: remove donation button in help section
other: remove extra Date, MIME-Version and X-Priority headers
other: remove email priority settings
14.8.1
bugfix: fix warning introduced with last version’s remote code execution fix
added: Russian translation
other: clean mail handling
14.8
feature: add Shortcode to insert forms
bugfix: fix remote code execution via file upload
enhanced: make TinyMCE plugin localization part of gettext
enhanced: use TinyMCE 4 API and redesign TinyMCE form insertion
added: Brazilian Portuguese and French translations
14.7
enhanced: replace Subscribe To Comments support with a more general approach to also support Subscribe To Comments Reloaded
added: Bosnian, Croatian, Serbian, Simplified Chinese and full Ukrainian translations
other: remove old WP Ajax Edit Comments support, because current versions work without special support
14.6.11
enhanced: API function my_cforms_action() can throw an exception
bugfix: several AJAX related JavaScript undefined function bugs introduced in 14.6.8
bugfix: repair non-AJAX comment form
other: remove support for old Comment Luv versions
14.6.10
enhanced: use WordPress 2.8 Widget API
bugfix: JavaScript error on flexigrid drag event
bugfix: show errors on sending mail
bugfix: mitigate some possible SQL injection attacks
other: remove attribution link, because the original cforms site is shut down
14.6.9
bugfix:
Download Entries on Tracking not working
other: cut old changelog because of rendering problems with too big readme.txt file on wordpress.org
14.6.8
enhanced: full German and Italian translations
enhanced: use jquery-ui-sortable instead of its ancient Interface Elements predecessor
added: store version in database again
added: migration for month and day names
14.6.7
enhanced: reorganize JavaScript files to provide better dependency management
enhanced: bump up ClockPick to the newest version
enhanced: bump up jqModal to the newest version
enhanced: use jQuery wrapper for md5.js
enhanced: replace the color picker with iris (wordpress standard since 3.5)
feature: uninstallation deletes cforms database content
bugfix: captcha preview in global settings renders correctly
other: remove kibo dependency
other: removed unused images and code (including
GPL incompatible
, stolen JavaScript code)
other: replace donation button
14.6.6
bugfix: wrong AJAX MIME type
added: guideline to upgrade from original cforms
other: removed old upgrade code
other: moved some additional information in textfiles to readme.txt
14.6.5
other: reintroduced the public insert_cform function
14.6.4
bugfix: hanging form submission
14.6.3
feature: Use the ____Plugin_Localization directory to store and distribute some GPL translations
enhanced: unobfuscate JavaScript changes from version 10.3 on and kick out js_src.zip which was not updated since then
enhanced: WordPress function wp_mail is used for mails and direct PHPMailer support is removed
enhanced: make use of the native WordPress AJAX features
enhanced: get rid of the data.tmp and abspath.php files
enhanced: get rid of some paths and urls in the database
enhanced: bump up flexigrid to the newest version
other: replaced the captcha fonts with GPL fonts
other: reintroduced attribution link, that is opt-in now, which is demanded by the wordpress.org plugin guidelines
other: prefix function names and class names with cforms2, which is demanded by wordpress.org
other: remove the custom plugin update check
other: remove of a lot of old code which is not needed for WordPress 3.3+
other: remove v13 update information
other: move and rework changelog to be Markdown-compatible and have a tag subset
14.6.2
bugfix: issues upgrading from older versions of cforms
other: removed link at the bottom of the contact form
14.6.1
bugfix: SSL support on file includes
bugfix: double slash in file includes
14.6
added: NEW: my_cforms_filter() in my-functions.php (input filter)
bugfix: Security/SPAM issue with TellAFriend feature
added: Avoiding wpautop screwing with the layout
added: Changed the_content filter priority to deal with themes demanding wpautop
bugfix: multi-part forms: RESET button resets complete input and not just session
14.5
added: WP3.4 compliance
bugfix: CAPTCHA security issue; can’t override captcha settings via URL params
bugfix: re-enabled version update info on the native WP plugins page
14.2
added: added more IQ to my-functions.php:
“adminEmailSUBJ” & “autoConfSUBJ” to change the subject line during run-time
Also, check out Regis’ code example in this new section!
Thanks Regis!
added: “\n” in the default text of textarea fields is recognised as a new line character
bugfix: Call-time pass-by-reference in lib_aux.php
bugfix: XML download, imports now nicely into excel, even with multi-line fields
bugfix: corrected superfluous html5***** settings for non html5 fields
bugfix: bigger field label issues when using custom IDs and regexp
bugfix: localization issue with lib_editor.php and added French translation for the editor. Thanks Regis!
14.1
bugfix: localization in wizard popups
bugfix: array declaration error some experienced in lib_activate.php
bugfix: header inclusion/exclusion on specific pages
14.0
enhanced: tabbed navigation between form configuration fields
added: date picker support for year selection drop down
added: HTML5 support, new Global Settings (must be enabled first) and Form Options:
html5color, html5date, html5datetime, html5datetime-local, html5email, html5month,
html5number, html5range, html5search, html5tel, html5time, html5url, html5week
added: new my_cforms_logic() routines “fileDestination”, “fileDestinationTrackingPage” for uploads
bugfix: date picker start day
bugfix: loading of calendar style (css)
bugfix: form submission restrictions (from/to date and number)
bugfix: extra slash removed from plugin URL (fixes path to custom CSS file in /cforms-custom/)
13.2.2
bugfix: CC field issues for MP forms
bugfix: Reply-To fixed in admin email
bugfix: fixed ‘custom names’ form feature
added: hidden field default value supports cforms {default variables},eg. UserID, Name etc.
13.2.1
bugfix: undefined function ‘my_cforms_logic’
13.2
bugfix: XSS security issue with lib_ajax.php
bugfix: several fixes around “CC: me” field
enhanced: added Help Note on how to use {Custom Variables} in multi-page forms
bugfix: default checkbox state is not restored on form reload (user choice remains)
bugfix: removed depreciated eregi() & split() calls
enhanced: better support for SSL and multi-site deployments (WP v3x!)
bugfix: “Corrupted Content Error” on FF when backing up settings
feature: empty fields can now be excluded from the admin email
(Admin Email Message Options)
bugfix: multi-page forms: the “disable email attachments” setting for individual
forms is now being considered in the final admin email
enhanced: fixed several issues with multi page forms (accidental auto resets etc.),
forms now need to be manually reset via form reset button (setting),
no auto form reset anymore when on first form!
form session is properly remembered.
enhanced: calendar.css adjustments to make styles specific to cforms
13.1
bugfix: radio button fix
13.0
other: WP3.3 compliance
other: a new more modern default theme/style (cforms2012.css)
other: WP 3.3 jQuery / jQueryUI is now being used for the date picker!
other: link to supported date formats added to global settings screen
other: enhanced dashboard layout / listings
other: enhanced in-field editing on tracking page (“view records area”)
bugfix: checkbox “default state” setting fixed
bugfix: checkboxgroup “default states” & “new line” settings fixed
bugfix: several admin screens related fixes
bugfix: tracking page, download options fixed (header, URLs etc.)
other: checkbox fields now include a “checked symbol”, instead of the word “on”
other: email layout enhancements (optimized for gmail & HTML capable clients)
!!! NOTE: in order to fully enable the new layout for old forms, you MUST
reset the Admin & Auto Confirmation Messages (see button above each)
12.2
other: pare_str() caused issues for some, commented out now
12.1
bugfix: minor datepicker adjustment (for anyone that uses non standard date display)
12.0
other: WP3.2.1 compliance
other: upgraded to jQuery 1.6.2 (datepicker)
bugfix: corrected WP comment form issue ($usermessage_text)
bugfix: Zip Code RegExp in the Help Seection corrected
bugfix: date picker fix for WP3.2
11.9
bugfix: IE9 date picker fix
11.8
bugfix: fixing PHP’s issue with uksort()
bugfix: upload fields in forms could cause hang ups when submitted from iphone/ipad
other: enhanced path determination in cforms.js, should help to avoid issues going forward
other: session check in cforms.php to better support existing sessions (shopping carts etc)
11.7.3
bugfix: stalling of upload forms fixed (or ones with alternative form action)
11.7.2
other: enhanced support for form field arrays, e.g. : my-field[id:address[]]
bugfix: fixed jQuery wizard editor error
bugfix: fixed “upload field” handling & form error (stalling)
bugfix: sorting fixed for API call “get_cforms_entries()” – hopefully for good
11.7.1
bugfix: fixed function_exists() call in lib_functions.php
bugfix: fixed some date picker related bugs
bugfix: fixed PHP call insert_cforms() to accept “Form Names” as input (again)
11.7
bugfix: much enhanced/fixed REGEXP support for multi-line fields, to better support anti
SPAM measures, e.g. : ^(?!.
(xxx|seo|ptimization)).
11.6.1
bugfix: fixed missing spaces in multi-line text fields
11.6
added: addded Form Name to