CVE-2026-85641

Formidable Forms WordPress plugin (versions before 6.35 ) contains an unauthenticated stored content injection vulnerability. The root cause is that the plugin does not restrict who can set the updated_by parameter, which records the user who last edited a form entry. Because the plugin relies on...