CVE-2022-29622

CVE-2022–29622: анализ неуязвимости Эта кодовая база создана, чтобы помочь специалистам по безопасности и разработчикам понять, почему я считаю, что Formidable не был уязвим к CVE-2022-29622. Я изложил свой анализ здесь: CVE-2022–29622: анализ неуязвимости Поскольку некоторые не поняли этого, я...

Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 — Неаутентифицированная инъекция PHP-объектов Описание: Плагин Formidable Forms для WordPress подвержен уязвимости инъекции PHP-объектов в версиях до 6.1.2 включительно через десериализацию непроверенного ввода из отправленных форм. Это позволяет...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — 취약한 Docker 실습 환경 CVE-2017-20192Formidable Forms 2.05.03 저장형 XSS용 재현 가능한 Docker 실습 환경입니다. 빠른 시작 docker compose up -d --build 대상: http://127.0.0.1:18080 검증 실습 도우미 이 도우미 스크립트는 다음을 수행합니다: 비인증 상태로 조작된 항목을 제출합니다 WordPress 관리자로 로그인합니다 Formidable 관리자 항목 보기 를...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Удаленное выполнение кода для подписчиков и выше Использование usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Скрипт удаленного выполнения кода для подписчиков и выше options: -h, --help...

CVE-2021-24884

CVE-2021-24884 XSS2RCE в Formidable 4.09.04 Formidable 4.09.04 позволял внедрять определённые HTML-теги, такие как , , , и . Это могло позволить неаутентифицированному удалённому злоумышленнику использовать HTML-инъекцию, внедряя вредоносную ссылку. HTML-инъекция может обмануть аутентифицированны...

CVE-2026-19857

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

EUVD-2026-80218

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Formidable Forms versions 6.34...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Stored Content Injection vulnerability

Unauthenticated Stored Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Formidable Forms versions 6.34...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641

The Formidable Forms WordPress plugin (versions before 6.35 ) is vulnerable to Unauthenticated Stored Content Injection via the updated_by parameter. The plugin fails to restrict who can set the identifier used to record which user last edited a form entry. Because the system relies on this ident...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

PT-2026-93324

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...