EUVD-2026-80218
GHSA-hgfq-v6h8-89x5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network-reachable form endpoint (PR:N/UI:N) but AC:H because exploitation needs custom HTML containing a supported token, with only limited confidentiality/integrity impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when it substitutes a supported token into a form's custom HTML, allowing unauthenticated visitors to have arbitrary shortcodes, with attacker-chosen attributes, executed server-side on any page displaying an affected form.
AnalysisAI
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress site running Formidable Forms below 6.35 that has an attacker-reachable form whose custom HTML field contains a supported token (i.e. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signal set is internally consistent but points to a moderate, situational risk rather than a critical one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Formidable Forms plugin to 6.35 or later; the WPScan advisory (https://wpscan.com/vulnerability/5ff439f4-aa99-4198-b908-0cf098656cf7/) is the authoritative reference supplied for this CVE, and the fixed version is stated directly in the CVE description as 6.35. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Formidable Forms
View allThe Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow
The Formidable Forms - Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress i
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for Word
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder T
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for Word
Missing Authorization vulnerability in Strategy11 Team Formidable Forms formidable allows Exploiting Incorrectly Configu
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user las
Share
External POC / Exploit Code
Leaving vuln.today