Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder, CVE-2026-19857

CVE, Research URL: CVE-2026-19857
Home page URL: Security reports for Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Application: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
Published on: Sep 16, 2026
Research Description: The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
Affected versions: max 6.35.
Status: vulnerable

Formidable Forms &#8211; Contact Form, Survey, Quiz, Payment, Calculator Form &amp; Custom Form Builder, CVE-2026-19857