CVE-2026-18331 Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter

Formidable Forms for WordPress (all versions ≤ 6.33.1) is vulnerable to unauthenticated stored XSS via the frm_user_id parameter. The root cause is insufficient input sanitization and output escaping: when an attacker forges frm_user_id to match an administrator's user ID (discoverable through th...