Is it safe use wp_editor in public contact form

It should be fine and secure, as Horttcore mentioned it isn’t making any database or backend changes it is simply displaying the tinymce editor. There are other plugins you could use of course but I don’t see any problems doing exactly what you are doing.

To answer your other question, I believe the text/visual switch is stored in a cookie so only you would see this change and only if you switched it on the public form yourself – other people changing it on the public end won’t change your settings for text/visual on the backend.

Related Posts:

  1. what is a auth_user_file.txt?
  2. How to view PHP on live site
  3. Is moving wp-config outside the web root really beneficial?
  4. Hide the fact a site is using WordPress?
  5. Verifying that I have fully removed a WordPress hack?
  6. Can I Prevent Enumeration of Usernames?
  7. Best way to eliminate xmlrpc.php?
  8. If a hacker changed the blog_charset to UTF-7 does that make WordPress vulnerable to further attacks?
  9. Should I remove install.php and install-helper.php?
  10. Are Nonces Useless?
  11. What is the difference between esc_html filter vs attribute_escape filter?
  12. How do I technically prove that WordPress is secure?
  13. Which KSES should be used and when?
  14. How do WordPress Nonces Work?
  15. How can I easily verify a core or plugin update has not broken anything?
  16. Disable comment windows for all existing posts (pages/blogposts)
  17. Generate WordPress salt
  18. Stop wordpress automatically escaping $_POST data
  19. Secure my “add_settings_field” translation?
  20. how can i embed wordpress backend in iframe
  21. Handling nonces for actions from guests to logged-in users
  22. WordPress Logout Only If User Click Logout or If User Delete Browser History
  23. Can I force a password change?
  24. How brute-forcer knows that the password is cracked for target username?
  25. What is pclzip.lib.php file that wordfence think it’s a malicious code
  26. Can someone (Support of my themeprovider) get access to my server If I send them my admin login?
  27. How to disable XML-RPC from Linux command-line in a total way?
  28. How to remove javascript malware in wordpress site [closed]
  29. Completely remove the author url
  30. Securing my WordPress Files and Directories
  31. About WordPress site security
  32. Single sign-on: wp_authenticate_user vs wp_authenticate
  33. How to allow internal links using wp_kses filtration
  34. How does Cross Site Scripting (XSS) work exactly? [closed]
  35. How does the “authentication unique keys and salts” feature work?
  36. vs WordPress Security
  37. esc_html__ security : what for in this example?
  38. Using HTACCESS for Secret Access
  39. wp-config.php being written by attacker
  40. Definitive wordpress directory ownership and permissions on linux
  41. XML-RPC errors they know my username?
  42. Is [admin / admin] acceptable for all local websites?
  43. Simple Online Payment for Event Registration [closed]
  44. What may be causing failure of auto-install features in WordPress (v3.0.3)?
  45. Client side HTTP parameter pollution (reflected)
  46. Local file inclusion critical security issue [closed]
  47. Malware script in database post table only? [closed]
  48. Best practices to assert current_user_can() with guests
  49. XMLRPC slow and weird websites/services
  50. Are there security risks in working directly in the themes folder that builds into a theme folder?
  51. Is it safe to hand over the admin rights?
  52. Are un-sanitized theme options more vulnerable to malicious scripts than the theme editor?
  53. Secure WordPress: Change admin
  54. Changing the default header name
  55. how much information can we hide when using wordpress cms?
  56. disable tags on wordpress text editor
  57. Wordfence detects change in wp-admin/includes/upgrade.php
  58. Basic password protection without using users and roles
  59. System setting changed by system user
  60. Does meta-data need to be sanitized?
  61. Will there be security updates for WordPress 4.9.9
  62. Any known bugs that could cause disappearance of the wp_users table?
  63. On new server, site got hacked, permissions a bit strange? Please help
  64. Are SVG image files safe to upload? Why WP defines them as a security risk? [duplicate]
  65. Restrict Access without Creating Users
  66. How to obfuscate wp-config.php or code
  67. Security issue with ‘paged’ and ‘posts_per_page’ parameters taken directly from a POST request?
  68. How to prevent to direct access of my custom plugin folder/files
  69. Checking for origin of a xmlrpc request
  70. RESTRICT EDIT of PHP files?
  71. wp-content – permissions for files/folders created by apache
  72. How can I restrict access to specific parts of a page, not just the page itself?
  73. User generated content and security
  74. Are major WordPress updates mandatory for security?
  75. i moved wp-config.php outside of public html and this broke my website
  76. Monitor wordpress all external calls
  77. Is it safe to use the basic administration with reduced rights for private member space
  78. Securing WordPress running on Azure platform
  79. Verifying that I have fully removed a WordPress hack?
  80. Spam Registrations
  81. How can I have more confidence that WP plugins aren’t getting and storing user data?
  82. Standard Method for Securing a WordPress Site
  83. wordpress security (only one part of the site)
  84. Avoid ‘uploads’ 777 permissions: Potential threat or clean solution?
  85. Any way to disable /wp-login.php redirecting to the site folder?
  86. Folder Permissions + Security Concerns
  87. Malware/Permission bug removal?
  88. Could a user account with a stolen password compromised entire WP site?
  89. Step by Step Instructions for Making Media/Uploads Private to Only Logged-In Users
  90. Secure a WordPress website in 2019: one plugin or a combinations of them?
  91. What are the different types of firewall protections available for a WordPress website?
  92. Run a security scan on WordPress site that has .htaccess password [closed]
  93. Is this a WordPress security bug?
  94. Competitor is somehow accessing MetaData on a hidden WordPress site
  95. WordPress Hacks/Defacing [closed]
  96. How do you search for backdoors from the previous IT person?
  97. Possible to change email address in keypair?
  98. Why is SSH password authentication a security risk?
  99. Is wp-cron.php vulnerable to external attacks and how to protect it?
  100. How to address security vulnerabilities: LUCKY13, BEAST, and BREACH