WP Manifestindependent plugin directory
manifest / forms / cotlas-simple-form

Cotlas Simple Forms WP Registry grade B. Medium-severity findings · 1 findingWP RegistryMedium-severity findings · 1 findingOpen the reportB

Simple Form plugin for our client sites

★ 0stars
v2.0.7latest · 5mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/cotlaswebhost/cotlas-simple-form/archive/refs/heads/main.zip
Updates itself. It ships its own updater (Update URI header), so new versions appear under Dashboard → Updates.

Cotlas Simple Forms is a WordPress form builder plugin by Cotlas Web Solution. It provides a block-based form builder for contact forms, login forms, registration forms, payment forms, donation forms, and frontend post submission forms.

Features

  • Block-based form builder for WordPress.
  • Form types: normal/contact, login, registration, payment, donation, and frontend post submission.
  • Payment and donation redirect URL support after successful submission.
  • AJAX form submissions with frontend response handling.
  • Submission storage inside WordPress admin.
  • File upload support.
  • Email notifications and optional user confirmation emails.
  • SMTP settings for plugin emails or global WordPress emails.
  • Cloudflare Turnstile spam protection.
  • Google Places support for location fields.
  • Multi-step and conversational form layouts.
  • Dashboard with tabs for forms, settings, submissions, email templates, and activity logs.
  • GitHub auto-updater support from this repository.

Installation

  1. Download or clone this repository.
  2. Upload the plugin folder to: wp-content/plugins/cotlas-simple-forms
  3. Activate Cotlas Simple Forms from WordPress admin.
  4. Go to Cotlas Forms > Dashboard to start creating forms.

Shortcode

After creating a form, copy its shortcode from the form editor sidebar:

[csf_form id="123"]

Place the shortcode on any page, post, or template where you want the form to appear.

Form Types

Cotlas Simple Forms supports these form behaviors:

  • Normal: Standard contact or enquiry form.
  • Login: WordPress login form.
  • Registration: WordPress user registration form.
  • Payment: Saves the submission and redirects users to a payment URL.
  • Donation: Saves the submission and redirects users to a donation URL.
  • Frontend Add Post Form: Creates WordPress posts from frontend submissions.

For payment and donation forms, set the Redirect URL after submission in the form settings. This can be a payment gateway URL, donation checkout link, or thank-you page.

Admin Dashboard

The plugin dashboard includes tabs for:

  • Dashboard
  • All Forms
  • Add Form
  • Settings
  • Submissions
  • Email Templates
  • Activity Log

The sidebar menu is ordered the same way for quick access.

GitHub Auto-Updater

This plugin includes a GitHub updater that checks the latest release from:

https://api.github.com/repos/cotlaswebhost/cotlas-simple-form/releases/latest

To publish an update:

  1. Update the plugin version in cotlas-simple-forms.php.
  2. Commit and push the code to GitHub.
  3. Create a GitHub release with a matching version tag, for example: v1.1.3

WordPress will show the update when the release version is newer than the installed plugin version.

For private repositories or higher GitHub API limits, define this in wp-config.php:

define( 'COTLAS_GITHUB_TOKEN', 'your_github_token_here' );

Development

Main plugin file:

cotlas-simple-forms.php

Important folders:

admin/       Admin page classes
assets/      CSS and JavaScript
classes/     Upgraded plugin services
inc/         GitHub updater
includes/    Legacy plugin classes
templates/   Admin templates

Version

Current version: 2.0.7

Author

Cotlas

Releases

14 releases.

Tag
Published
v2.0.7 latest
May 20, 2026 5mo ago
May 19, 2026 5mo ago
May 19, 2026 5mo ago
May 19, 2026 5mo ago
May 19, 2026 5mo ago
May 19, 2026 5mo ago
May 19, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago
May 18, 2026 5mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

B grade

Security

Cotlas Simple Forms 2.0.7 · audited by WP Registry

Medium-severity findings.

1 medium
Audited release
2.0.7
Findings
1
Worst severity
medium
Content hash
ca59dc0d2bf88cc0b7da75f3…

Findings

  • medium Unauthenticated media upload via csf_editorjs_upload

    csf_handle_editorjs_upload is registered on wp_ajax_nopriv_ and only verifies a nonce before wp_handle_upload + wp_insert_attachment. No current_user_can('upload_files'). Any visitor who can obtain the public form nonce can inject images into the Media Library.

    cotlas-simple-forms.php:63-116

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.