CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 — Неаутентифицированная инъекция PHP-объектов Описание: Плагин Formidable Forms для WordPress подвержен уязвимости инъекции PHP-объектов в версиях до 6.1.2 включительно через десериализацию непроверенного ввода из отправленных форм. Это позволяет...

CVE-2022-29622

CVE-2022–29622: 비취약성 분석 이 코드베이스는 보안 전문가와 개발자가 Formidable이 CVE-2022-29622에 취약하지 않다고 생각하는 이유를 이해할 수 있도록 만들어졌습니다. 이에 대한 분석은 여기에 작성했습니다: CVE-2022–29622: 비취약성 분석 일부 사람들이 이해하지 못했기에, 실제 실행되는 코드를 사용하여 제 요점을 설명하려고 합니다. 서버 서버는 index.mjs에 구현되어 있습니다. Formidable 버전 3.1.4를 사용하여 원하는 파일을 업로드합니다. Formidable을 다음과 ...

Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...

Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure

The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frmformspreview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form. id: CVE-2017-20194 info...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — 취약한 Docker 실습 환경 CVE-2017-20192Formidable Forms 2.05.03 저장형 XSS용 재현 가능한 Docker 실습 환경입니다. 빠른 시작 root@kitploit: docker compose up -d --build 대상: http://127.0.0.1:18080 검증 실습 도우미 이 도우미 스크립트는 다음을 수행합니다: 비인증 상태로 조작된 항목을 제출합니다 WordPress 관리자로 로그인합니다 Formidab...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Удаленное выполнение кода для подписчиков и выше Использование root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Скрипт удаленного выполнения кода для подписчиков и выше option...

CVE-2021-24884

CVE-2021-24884 XSS2RCE в Formidable 4.09.04 Formidable 4.09.04 позволял внедрять определённые HTML-теги, такие как , , , и . Это могло позволить неаутентифицированному удалённому злоумышленнику использовать HTML-инъекцию, внедряя вредоносную ссылку. HTML-инъекция может обмануть аутентифицированны...

CVE-2026-15990

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frmgraph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-15990 Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frmgraph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-15990

The Formidable Charts WordPress plugin is vulnerable to Directory Traversal in versions up to and including 2.0.1 , via the frm_graph parameter. An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information. Exploitation requires Formidable Forms L...

EUVD-2026-66424

The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frmgraph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...

CVE-2026-18331

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331

Formidable Forms for WordPress (all versions ≤ 6.33.1) is vulnerable to unauthenticated stored XSS via the frm_user_id parameter. The root cause is insufficient input sanitization and output escaping: when an attacker forges frm_user_id to match an administrator's user ID (discoverable through th...

EUVD-2026-66294

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-82097

Name of the Vulnerable Software and Affected Versions Formidable Charts versions prior to 2.0.2 Description An issue exists that allows unauthenticated attackers to perform Directory Traversal, a method used to access files and directories that are stored outside the web root folder. By...

ROOT-APP-NPM-CVE-2022-29622 CVE-2022-29622 in formidable - Patched by Root

Root has patched CVE-2022-29622 in the formidable package for Root:npm. Multiple fixed versions available...

CVE-2026-16230

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the deletefile function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an...

CVE-2026-16230

The CVE concerns the Formidable Digital Signatures plugin for WordPress, where the delete_file function fails to validate file paths in all versions up to 3.0.6. This allows unauthenticated attackers to delete files on the server by submitting an attacker-controlled filename via item_meta[field_i...