Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...

CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - Unauthenticated PHP Object Injection Description: The Formidable Forms plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 6.1.2 via deserialization of untrusted input from form submissions. This allows...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — Vulnerable Docker Lab Reproducible Docker lab for CVE-2017-20192 Formidable Forms 2.05.03 stored XSS. Quickstart docker compose up -d --build Target: http://127.0.0.1:18080 Validate lab helper This helper script: submits a crafted entry unauthenticate...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Usage usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message and exit -w URL,...

CVE-2026-85642

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

CVE-2026-85642 Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

CVE-2026-85642

The Formidable Forms WordPress plugin (versions before 7.0 ) is vulnerable to a Denial of Service (DoS) attack because it fails to verify the identity of the caller before recording timestamps for rate limiting payment gateway verification requests . An unauthenticated attacker can exploit this f...

EUVD-2026-107084

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

CVE-2026-85642 Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

WordPress Formidable Forms plugin < 7.0 - Unauthenticated Payment Gateway Connect Verification DoS vulnerability

Unauthenticated Payment Gateway Connect Verification DoS vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Formidable Forms versions 7.0...

PT-2026-120480

The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to b...

CVE-2026-19857

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

EUVD-2026-80218

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Jakub Herman in WordPress Plugin Formidable Forms versions 6.34...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...