EUVD-2026-66294
GHSA-hjj8-x8wc-9cj2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Stored XSS payload requires admin to visit the entries page (UI:R); scope changes to admin browser context (S:C); no availability impact identified.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Formidable Forms - WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID - discoverable via the public WordPress REST API - an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.
AnalysisAI
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required to submit a form entry - the CVSS vector confirms PR:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N signals a high-priority network-exploitable flaw requiring no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Formidable Forms plugin to a version above 6.33.1 as soon as a patched release is confirmed available via the WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of all WordPress installations to identify Formidable Forms deployments running version 6.33.1 or earlier; disable the plugin on all affected instances where immediate patching is not feasible, and review WordPress admin access logs for any anomalous login patterns or administrative actions over the past 30 days. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today