WordPress Formidable Forms plugin <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'frmuserid' Parameter vulnerability discovered by daroo in WordPress Plugin Formidable Forms versions = 6.33.1...

CVE-2026-18331

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18331

Formidable Forms for WordPress (all versions ≤ 6.33.1) is vulnerable to unauthenticated stored XSS via the frm_user_id parameter. The root cause is insufficient input sanitization and output escaping: when an attacker forges frm_user_id to match an administrator's user ID (discoverable through th...

EUVD-2026-66294

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frmuserid' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. Thi...