CVE-2023-1405

CVE-2023-1405 Formidable Forms = 6.1.2 - 未经身份验证的PHP对象注入 描述： Formidable Forms WordPress插件在版本6.1.2及之前存在PHP对象注入漏洞，通过反序列化来自表单提交的不可信输入实现。这允许未经身份验证的攻击者注入PHP对象。受影响插件本身不存在POP链。如果目标系统上安装了其他插件或主题提供了POP链，则可能允许攻击者删除任意文件、检索敏感数据或执行代码。 root@kitploit: Type: plugin CVSS Score: 9.8 CVSS Vector:...

CVE-2023-2877

CVE-2023-2877 Formidable Forms 6.3.1 - Subscriber+ Ejecución Remota de Código Uso root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this help message...

Formidable Forms < 2.05.02 - Cross-Site Scripting

Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...

CVE-2026-19857

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857

The Formidable Forms WordPress plugin before version 6.35 is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is that a request-derived value can reach the WordPress shortcode parser when the plugin substitutes the [entry_key] token into a form's custom HTML, allowing ...

EUVD-2026-80218

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-19857 Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token

The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes,...

CVE-2026-85641

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

EUVD-2026-80199

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

WordPress Formidable Forms plugin 6.34 - Unauthenticated Stored Content Injection vulnerability

Unauthenticated Stored Content Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Formidable Forms versions 6.34...

CVE-2026-85641 Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter

The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in th...

CVE-2026-85641

Formidable Forms WordPress plugin versions before 6.35 are affected by an unauthenticated stored content injection vulnerability via the updated_by parameter. The plugin does not restrict who can set the identifier that records which user last edited a form entry, and it relies on that identifier...

CVE-2017-20192-formidable-forms

CVE-2017-20192 — Formidable Forms WordPress — 漏洞Docker实验室 CVE-2017-20192 （Formidable Forms 2.05.03 存储型XSS）的可复现Docker实验室。 快速开始 root@kitploit: docker compose up -d --build 目标： http://127.0.0.1:18080 验证（实验室辅助脚本） 此辅助脚本： 未经过身份验证 提交一个精心构造的条目 以WordPress管理员身份登录 获取Formidable 管理员条目视图 并检查存储的标记 root@kitploit...

WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...

CVE-2026-18331

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331

Formidable Forms for WordPress (all versions ≤ 6.33.1) is vulnerable to unauthenticated stored XSS via the frm_user_id parameter. The root cause is insufficient input sanitization and output escaping: when an attacker forges frm_user_id to match an administrator's user ID (discoverable through th...

CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-66294

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331: Improper Neutralization of Input During Web Page Generation

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

EUVD-2026-54303

The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...