Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — Vulnerable Docker Lab Reproducible Docker lab for CVE-2017-20192 Formidable Forms 2.05.03 stored XSS. Quickstart docker compose up -d --build Target: http://127.0.0.1:18080 Validate lab helper This helper script: submits a crafted entry unauthenticate...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2022-29622

CVE-2022–29622: Invulnerability Analysis This codebase was created to help security professionals and developers to understand why I think Formidable was not vulnerable to CVE-2022-29622. I have written up my analysis here: CVE-2022–29622: Invulnerability Analysis As some did not understand it, I...

CVE-2021-24884

CVE-2021-24884 XSS2RCE in Formidable 4.09.04 Formidable 4.09.04 allowed to inject certain HTML Tags like ,,, and . This could allow an unauthenticated, remote attacker to exploit a HTML-injection by injecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL,...

CVE-2026-121722

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

CVE-2026-121722 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

CVE-2026-121722

The WP E-Signature Formidable Forms Signature Online Contract Automation plugin (versions up to and including 2.0.5 ) is susceptible to a Missing Authorization vulnerability (CWE-862). This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels , potentially leading to u...

EUVD-2026-119992

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

PT-2026-140365

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

CVE-2026-121722: WP E-Signature Formidable Forms Signature Online Contract Automation: Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation…

Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation forms-signature-formidable-online-contract-automation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms Signature Online Contract...

WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Elieve in WordPress Plugin Formidable Forms Signature Online Contract Automation versions = 2.0.5...

CVE-2026-89435

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-89435

The Formidable Forms WordPress plugin (versions up to and including 6.35 ) is vulnerable to Arbitrary Plugin Installation via the file_url parameter. The root cause is insufficient URL prefix validation within the validate_url_is_in_s3_bucket() function, combined with a permission callback that r...

EUVD-2026-113736

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-89435 Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-89435 Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...

CVE-2026-89435: strategy11team: The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is…

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'fileurl' parameter parameter. This is due to insufficient URL prefix validation in...