199 matches found
Formidable Forms < 2.05.02 - Cross-Site Scripting
Formidable Form Builder for WordPress versions before 2.05.03 contains a stored cross-site scripting caused by insufficient input sanitization and output escaping in form parameters like 'afterhtml', letting unauthenticated attackers inject and execute arbitrary scripts in victims' browsers id:...
CVE-2017-20192-formidable-forms
CVE-2017-20192 — Formidable Forms WordPress — 취약한 Docker 실습 환경 CVE-2017-20192Formidable Forms 2.05.03 저장형 XSS용 재현 가능한 Docker 실습 환경입니다. 빠른 시작 root@kitploit: docker compose up -d --build 대상: http://127.0.0.1:18080 검증 실습 도우미 이 도우미 스크립트는 다음을 수행합니다: 비인증 상태로 조작된 항목을 제출합니다 WordPress 관리자로 로그인합니다 Formidab...
WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...
CVE-2026-18331
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2026-18331
Formidable Forms for WordPress (all versions ≤ 6.33.1) is vulnerable to unauthenticated stored XSS via the frm_user_id parameter. The root cause is insufficient input sanitization and output escaping: when an attacker forges frm_user_id to match an administrator's user ID (discoverable through th...
EUVD-2026-66294
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...
CVE-2023-1405
CVE-2023-1405 Formidable Forms = 6.1.2 - Iniezione di Oggetti PHP non autenticata Descrizione: Il plugin Formidable Forms per WordPress è vulnerabile all'Iniezione di Oggetti PHP nelle versioni fino alla 6.1.2 inclusa, tramite deserializzazione di input non fidato proveniente dall'invio dei modul...
CVE-2023-2877
CVE-2023-2877 Formidable Forms 6.3.1 - Esecuzione Remota di Codice per Subscriber+ Utilizzo root@kitploit: usage: CVE-2023-2877.py -h -w URL -u USERNAME -p PASSWORD -pl PLUGIN -c CMD CVE-2023-2877 - Formidable Forms 6.3.1 - Subscriber+ Remote Code Execution Script options: -h, --help show this he...
EUVD-2026-54303
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...
CVE-2026-11361
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...
CVE-2026-11361 Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status
The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership...
CVE-2026-11361
Formidable Forms for WordPress (before 6.32.1) is affected by CVE-2026-11361 due to improper validation of PayPal subscription status, enabling unauthenticated users to bypass payment and trigger paid actions (content access, license delivery, membership activation) without charges. Impact aligns...
CVE-2026-65523
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-65523
CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions
EUVD-2026-53970
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-65523
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-65523 WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.1 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...