When I’ll find time I’ll write you recommendations about these holes.

Guys.

As I wrote above I found holes in three contact form plugins. All contact form plugins (like any other plugins) can have holes. So it’s better to attend to security and make security audit of all plugins and the whole sites.

The actual contact form page that your users see is not vulnerable to these attacks.

It’s not correct statement. Because actual contact form page is vulnerable too – in both WP-ContactForm and Contact Form ][ plguins.

Abuse of Functionality hole in both plugins (which is working at the contact page) allow to send spam to arbitrary emails via sites with any of these plugins.

Insufficient Anti-automation hole in WP-ContactForm (due captcha bypass) allow to send any amount of messages to admin (and to any email in case of Abuse of Functionality hole). Insufficient Anti-automation in Contact Form ][ (due lack of captcha) also allow to send any amount of messages to admin (and to any email in case of Abuse of Functionality hole). In both case Insufficient Anti-automation hole is at the contact page.

Only Cross-Site Request Forgery and Cross-Site Scripting holes in both plugins are exist at options page (options-contactform.php). But even in these case there some persistent XSS there which can be used to attack visitors of site at contact page form. So there are a lot of holes in both of these plugins (like in original WP-ContactForm 1.5).

You wrote incorrect link ;-) (this link cab be written in another post about 2nd WP plugin if you want to write about it).

The post where you linked is about vulnerabilities in Contact Form ][. I wrote about vulnerability in WP-ContactForm in other post: http://websecurity.com.ua/2335/ (and I wrote about many other holes in WP-ContactForm last year in MoBiC project).

These are similar plugins (Contact Form ][ and WP-ContactForm) and they both have vulnerabilities. Contact Form ][ made by Chip Cuccio and WP-ContactForm made by Douglas Karr - they both made from original WP-ContactForm 1.5 and both have made similar holes (and some holes left from original), but also have their own holes. And both these plugins need to improve their security.