Formidable Forms CVE-2026-85641

Requires the Formidable Forms plugin (before 6.35) with a public-facing form that accepts entries; the attacker can submit unauthenticated. The core prerequisite is that the plugin trusts a client-supplied identifier for 'who last edited the entry' and uses it to decide whether stored HTML is stripped - so an unauthenticated submitter sets that identifier to a privileged (administrator) user ID to bypass sanitization and forge attribution. The principal LIMITER is user interaction: the malicious markup only renders when an administrator (or other privileged user) actually opens the affected entry in the wp-admin entry view (UI:R). Impact is bounded to that admin view context and to false attribution; no authentication is required of the attacker, and default configurations with any public form are exploitable.

This is a genuine but modest-priority issue. The vendor CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects an unauthenticated, network-reachable weakness that requires admin user interaction (viewing the entry) and yields only limited integrity impact. Exploitation-probability signals are low and consistent: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, so this is not confirmed actively exploited. However, a public WPScan exploit exists, so proof-of-concept is available and the barrier to weaponization is low. The key tension is between the vendor's conservative I:L / S:U / C:N scoring and the actual mechanism: unauthenticated visitors can cause attacker-controlled HTML markup to be RENDERED in the wp-admin entry view that would normally be stripped. If that markup includes active script, this behaves like a stored XSS firing in an administrator's authenticated browser session - which realistically implies a scope change (S:C) and some confidentiality/integrity exposure the 4.3 base score understates. Net: low probabilistic risk (no active exploitation, tiny EPSS, niche trigger requiring an admin to open the entry) but the impact ceiling is higher than 4.3 suggests if the rendered markup is scriptable rather than benign formatting.

An unauthenticated attacker submits a Formidable Forms entry while also setting the 'last edited by' identifier to an administrator's user ID, which causes the plugin to skip HTML stripping and to falsely attribute the submission to that admin. When an administrator later opens the entry in wp-admin, the attacker-controlled markup renders in their authenticated session, and the forged attribution misleads the operator about who created the entry. A public WPScan proof-of-concept exists, lowering the effort to reproduce.