Vulnerabilities and security researches forformidable formidable
Direction: descendingOct 23, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-85642
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 21, 2026
- Research Description
- The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to be refused for the next 24 hours.
- Affected versions
-
Min 6.5, max 7.0.
- Status
-
vulnerable
Sep 17, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-19857
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 16, 2026
- Research Description
- The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
- Affected versions
-
max 6.35.
- Status
-
vulnerable
Aug 26, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-18331
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 26, 2026
- Research Description
- The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.
- Affected versions
-
max 6.34.
- Status
-
vulnerable
Aug 08, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-11361
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 07, 2026
- Research Description
- The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete, allowing unauthenticated users to bypass payment and trigger paid form actions — such as digital content access, license delivery, and membership activation — without being charged.
- Affected versions
-
max 6.32.1.
- Status
-
vulnerable
Jun 16, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 5a13ecee49d9b8fdebe842c92e4a3a5752d6aa6d
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 20, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 WordPress Formidable Forms plugin <=2.05.02 - SQL Injection (SQLi) vulnerability Blind SQL Injection (SQLi) vulnerability found by Jouko Pynnönen in WordPress Formidable Forms plugin (versions <=2.05.02). This vulnerability allows an attacker to enumerate databases and tables and retrieve their contents.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # baa6b8a740ef52f8affc7b0e16c89a88c4f9904c
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2016
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 1.06.04 WordPress Formidable Forms Plugin <= 1.06.03 - Remote Code Execution This plugin is prone to remote code execution because of ofc_upload_image.php file parameters ($_GET[ 'name' ] and $HTTP_RAW_POST_DATA). Update the plugin.
- Affected versions
-
max 1.06.04.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 3c9f8dac8e25723d0980c4d4e49f133274c05f76
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2016
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.0 WordPress Formidable Forms Plugin <= 1.07.11 - Blind SQL Injection Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Update the plugin.
- Affected versions
-
max 2.0.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 701cd058cf2a4a832f3f04cce757d516714b34ba
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 20, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 WordPress Formidable Forms plugin <=2.05.02 - Multiple Cross-Site Scripting (XSS) vulnerabilities Multiple Cross-Site Scripting (XSS) vulnerabilities found by Jouko Pynnönen in WordPress Formidable Forms plugin (versions <=2.05.02). Reflected Cross-Site Scripting vulnerability in form preview and Stored Cross-Site Scripting vulnerability in form entries.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # e94258f3b64e541c3e2e79f2da8b414addc82dc9
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 20, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 WordPress Formidable Forms plugin <=2.05.02 - Multiple vulnerabilities Multiple vulnerabilities found by Jouko Pynnönen in WordPress Formidable Forms plugin (versions <=2.05.02). Unauthenticated preview function allowing shortcodes, unauthenticated form entries retrieval and Server-Side Code Execution via iThemes Sync.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # f3cc47e38cb751419866195d33aa874523a560ed
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 16, 2022
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 5.5.5 Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery The Formidable Form Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 5.5.4 due to insufficient URL restrictions on the 'plugin' parameter passed to the the install_addon function. This makes it possible for authenticated users, with administrative privileges, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- Affected versions
-
max 5.5.5.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # e37777690a46b6efaa14ddbac2c361203b67759f
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 12, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 Formidable Form Builder < 2.05.03 - Unauthenticated Information Disclosure The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # a2d8f1a01b7d022fe9f273a28d36a49d331787c1
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 13, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 Formidable Form Builder < 2.05.03 - SQL Injection The Formidable Form Builder plugin for WordPress is vulnerable to SQL Injection via the ‘display-frm-data’ shortcode in versions before 2.05.03 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 6b9c025cb77a1b33c493aba3957721459808ba59
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 13, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 Formidable Form Builder < 2.05.03 - Reflected Cross-Site Scripting The Formidable Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'before_html' parameter passed through the frm_forms_preview AJAX action in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser whenever they successfully trick a victim into performing an action like clicking on a link.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 18d29339560dfec997e38032c4a4179eb1851985
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 16, 2016
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.0.22 Formidable Form Builder <= 2.0.21 - Missing Authorization Checks The Formidable Form Builder plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 2.0.21. This is due to missing nonce and capability checks on the 'frm_fill_licenses' and 'frm_ajax' AJAX actions. This makes it possible for unauthenticated attackers to access leaked nonces and modify form fields.
- Affected versions
-
max 2.0.22.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # a754a931adf78780748b53f5208291616152b920
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 16, 2022
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 5.5.5 Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery The Formidable Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5.4. This is due to missing or incorrect nonce validation on two functions handling migrations and data loading. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 5.5.5.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # eefd255d525d60fa66e2255614dcfaa8aebb7f25
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 21, 2022
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 5.5.5 WordPress Formidable Forms Plugin <= 5.5.4 is vulnerable to Cross Site Request Forgery (CSRF) Update the WordPress Formidable Form Builder plugin to the latest available version (at least 5.5.5). Wordfence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Formidable Forms Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 5.5.5.
- Affected versions
-
max 5.5.5.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # b79f2c4d664b29b0d307b50e4759035e4049b277
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 01, 2023
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 5.5.7 Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery The Formidable Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.5.6. This is due to missing or incorrect nonce validation on the 'destroy' function. This makes it possible for unauthenticated attackers to delete form entries via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 5.5.7.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 051bc0138040a592927e512d0b185a3d22a03c74
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2016
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 1.06.09 WordPress Formidable Forms Plugin <= 1.06.08 - Unspecified Vulnerabilities This plugin is prone to unspecified issues. Update the plugin.
- Affected versions
-
max 1.06.09.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 950d81be168f11d88a00d49530b590190f245264
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 21, 2022
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 5.5.5 WordPress Formidable Forms Plugin <= 5.5.4 is vulnerable to Server Side Request Forgery (SSRF) Update the WordPress Formidable Form Builder plugin to the latest available version (at least 5.5.5). An unknown person discovered and reported this Server Side Request Forgery (SSRF) vulnerability in WordPress Formidable Forms Plugin. This could allow a malicious actor to cause a website to execute website requests to an arbitrary domain of the attacker. This could allow a malicious actor to find sensitive information. This vulnerability has been fixed in version 5.5.5.
- Affected versions
-
max 5.5.5.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # d011d0f8d6808b6f82f22f4bd751233b76ed4488
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 13, 2017
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 Formidable Form Builder < 2.05.03 - Unauthenticated Stored Cross-Site Scripting The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # e1d3517b-31dc-4ca9-a418-10075e2069a8
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 2.05.03 Formidable Forms < 2.05.03 - Multiple Vulnerabilities The plugin was affected by Multiple Vulnerabilities: - Unauthenticated preview function allowing shortcodes - SQL injection - Unauthenticated form entries retrieval - Reflected XSS in form preview - Stored XSS in form entries - Server-side code execution via iThemes Sync
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 75b65b2898836c07534e8dd16dc8098b32d7a4b8
- CVE, Research URL
- Home page URL
- Application
- Date
- May 31, 2023
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 6.3.1 Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation The Formidable Forms plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation and activation due to a missing capability check on the screen_page() and can_install_addon_api() functions in versions up to, and including, 6.3. This makes it possible for authenticated attackers, with minimal permissions such as subscribers to retrieve a valid token from the welcome page, and then subsequently install and activate arbitrary plugins onto the site utilizing that key. This can easily be leveraged by attackers to achieve remote code execution as they simply need to install another plugin with a vulnerability or functionality that will aid in further exploitation.
- Affected versions
-
max 6.3.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # 4fe35f73997a2125bd20d9992a84c4f99c05bc9d
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 01, 2023
- Research Description
- Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder [formidable] < 6.3.1 WordPress Formidable Forms Plugin < 6.3.1 is vulnerable to Broken Access Control Update the WordPress Formidable Forms plugin to the latest available version (at least 6.3.1). WordFence discovered and reported this Broken Access Control vulnerability in WordPress Formidable Forms Plugin. This vulnerability has been fixed in version 6.3.1.
- Affected versions
-
max 6.3.1.
- Status
-
vulnerable
Apr 13, 2026
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-2888
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 14, 2026
- Research Description
- The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This is due to the `frm_strp_amount` AJAX handler (`update_intent_ajax`) overwriting the global `$_POST` data with attacker-controlled JSON input and then using those values to recalculate payment amounts via field shortcode resolution in `generate_false_entry()`. The handler relies on a nonce that is publicly exposed in the page's JavaScript (`frm_stripe_vars.nonce`), which provides CSRF protection but not authorization. This makes it possible for unauthenticated attackers to manipulate PaymentIntent amounts before payment completion on forms using dynamic pricing with field shortcodes, effectively paying a reduced amount for goods or services.
- Affected versions
-
max 6.29.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2026-2890
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 14, 2026
- Research Description
- The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services.
- Affected versions
-
max 6.29.
- Status
-
vulnerable
Nov 24, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2024-11188
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 23, 2024
- Research Description
- The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
max 6.16.2.
- Status
-
vulnerable
Nov 22, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2024-9768
- CVE, Research URL
- Home page URL
- Application
- Date
- Nov 21, 2024
- Research Description
- The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
- Affected versions
-
max 6.14.1.
- Status
-
vulnerable
Oct 18, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2017-20194
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2024
- Research Description
- The Formidable Form Builder plugin for WordPress is vulnerable to Sensitive Data Exposure in versions up to, and including, 2.05.03 via the frm_forms_preview AJAX action. This makes it possible for unauthenticated attackers to export all of the form entries for a given form.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2017-20192
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 16, 2024
- Research Description
- The Formidable Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters submitted during form entries like 'after_html' in versions before 2.05.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser.
- Affected versions
-
max 2.05.03.
- Status
-
vulnerable
Aug 01, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2024-6725
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 31, 2024
- Research Description
- The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in all versions up to, and including, 6.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with form editing permissions and Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 6.11.2.
- Status
-
vulnerable
Jun 10, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2014-9309
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- The Formidable Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.07.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 1.07.11.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2022-45806
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 13, 2024
- Research Description
- Missing Authorization vulnerability in Strategy11 Form Builder Team Formidable Forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Formidable Forms: from n/a through 5.5.4.
- Affected versions
-
max 5.5.5.
- Status
-
vulnerable
Jun 07, 2024
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2021-24884
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 25, 2021
- Research Description
- The Formidable Form Builder WordPress plugin before 4.09.05 allows to inject certain HTML Tags like <audio>,<video>,<img>,<a> and<button>.This could allow an unauthenticated, remote attacker to exploit a HTML-injection byinjecting a malicous link. The HTML-injection may trick authenticated users to follow the link. If the Link gets clicked, Javascript code can be executed. The vulnerability is due to insufficient sanitization of the "data-frmverify" tag for links in the web-based entry inspection page of affected systems. A successful exploitation incomibantion with CSRF could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These actions include stealing the users account by changing their password or allowing attackers to submit their own code through an authenticated user resulting in Remote Code Execution. If an authenticated user who is able to edit Wordpress PHP Code in any kind, clicks the malicious link, PHP code can be edited.
- Affected versions
-
max 4.09.05.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2019-15780
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 29, 2019
- Research Description
- The formidable plugin before 4.02.01 for WordPress has unsafe deserialization.
- Affected versions
-
max 4.02.01.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2021-24608
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 25, 2021
- Research Description
- The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress plugin before 5.0.07 does not sanitise and escape its Form's Labels, allowing high privileged users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
- Affected versions
-
max 5.0.07.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-0816
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 27, 2023
- Research Description
- The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections.
- Affected versions
-
max 6.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-1405
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 16, 2024
- Research Description
- The Formidable Forms WordPress plugin before 6.2 unserializes user input, which could allow anonymous users to perform PHP Object Injection when a suitable gadget is present.
- Affected versions
-
max 6.2.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-2877
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 27, 2023
- Research Description
- The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution.
- Affected versions
-
max 6.3.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-6842
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 09, 2024
- Research Description
- The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the name field label and description field label parameter in all versions up to 6.7 (inclusive) due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By default, this only affects multi-site installations and installations where unfiltered_html has been disabled. However, in the formidable settings admins can extend form creation, deletion and other management permissions to other user types, which makes it possible for this vulnerability to be exploited by lower level user types as long as they have been granted the proper permissions.
- Affected versions
-
max 6.7.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2024-23522
- CVE, Research URL
- Home page URL
- Application
- Date
- May 17, 2024
- Research Description
- Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.This issue affects Formidable Forms: from n/a through 6.7.
- Affected versions
-
max 6.7.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2024-0660
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 06, 2024
- Research Description
- The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.7.2. This is due to missing or incorrect nonce validation on the update_settings function. This makes it possible for unauthenticated attackers to change form settings and add malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 6.8.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2009-4140
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 23, 2009
- Research Description
- Unrestricted file upload vulnerability in ofc_upload_image.php in Open Flash Chart v2 Beta 1 through v2 Lug Wyrm Charmer, as used in Piwik 0.2.35 through 0.4.3, Woopra Analytics Plugin before 1.4.3.2, and possibly other products, when register_globals is enabled, allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension through the name parameter with the code in the HTTP_RAW_POST_DATA parameter, then accessing it via a direct request to the file in tmp-upload-images/.
- Affected versions
-
max 1.06.03.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-6830
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 09, 2024
- Research Description
- The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected HTML code is rendered, potentially leading to admin area defacement or redirection to malicious websites. CVE-2024-23522 appears to be a duplicate of this issue.
- Affected versions
-
max 6.7.1.
- Status
-
vulnerable
Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder # CVE-2023-24419
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 28, 2023
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Form Builder Team Formidable Forms plugin <= 5.5.6 versions.
- Affected versions
-
max 5.5.7.
- Status
-
vulnerable