Formidable Forms
Monthly
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
Stored HTML injection in the WordPress Formidable Forms plugin before 6.35 allows unauthenticated visitors to submit form entries that carry a forged 'last edited by' identifier pointing to an administrator, causing the plugin to skip its normal HTML stripping and render attacker-supplied markup inside the wp-admin entry view; the same forgery falsely attributes the submission to an administrator. Exploitation requires a public-facing form on the site and, critically, requires a privileged user to actually open the poisoned entry in the admin entry view (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the real-world impact is bounded to that admin view context plus false attribution rather than full site compromise. Publicly available exploit code exists and a WPScan advisory documents the flaw, but EPSS is only 0.12% (2nd percentile) and there is no indication of active exploitation; the independent assessment rates this a genuine but modest-priority issue.
Missing Authorization vulnerability in Strategy11 Team Formidable Forms formidable allows Exploiting Incorrectly Configured Access Control Security Levels.5.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms - Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can exhaust the daily rate-limit allowance for payment gateway verification in the Formidable Forms WordPress plugin on sites running versions 6.5 through 6.x with a payment gateway configured, causing legitimate verification attempts to be refused for up to 24 hours. The plugin records the rate-limit timestamp without verifying the caller's identity, so the issue is a bounded availability impact against the verification function rather than a full site outage or system compromise. Publicly available exploit code exists, a vendor patch is available in version 7.0, and the independently assessed impact is availability-only.
Unauthenticated visitors can inject arbitrary WordPress shortcodes, including attacker-chosen attributes, into Formidable Forms versions before 6.35 because a request-derived value is substituted into a form's custom HTML and then passed through the shortcode parser server-side. Any page rendering an affected form will execute the injected shortcode, which can expose data or alter site behaviour depending on which shortcodes are installed on the target. Publicly available exploit code exists per WPScan, but CISA KEV does not list this issue and the CVSS score is moderate (4.8, AV:N/AC:H/PR:N/UI:N/C:L/I:L/A:N), reflecting configuration-dependent preconditions and limited impact.
Stored HTML injection in the WordPress Formidable Forms plugin before 6.35 allows unauthenticated visitors to submit form entries that carry a forged 'last edited by' identifier pointing to an administrator, causing the plugin to skip its normal HTML stripping and render attacker-supplied markup inside the wp-admin entry view; the same forgery falsely attributes the submission to an administrator. Exploitation requires a public-facing form on the site and, critically, requires a privileged user to actually open the poisoned entry in the admin entry view (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), so the real-world impact is bounded to that admin view context plus false attribution rather than full site compromise. Publicly available exploit code exists and a WPScan advisory documents the flaw, but EPSS is only 0.12% (2nd percentile) and there is no indication of active exploitation; the independent assessment rates this a genuine but modest-priority issue.
Missing Authorization vulnerability in Strategy11 Team Formidable Forms formidable allows Exploiting Incorrectly Configured Access Control Security Levels.5.4. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms WordPress plugin before 6.14.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Formidable Forms - Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘html’ parameter in. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Strategy11 Form Builder Team Formidable Forms allows Code Injection.7. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Formidable Forms - Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Formidable Forms WordPress plugin before 6.3.1 does not adequately authorize the user or validate the plugin URL in its functionality for installing add-ons. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.