Executive brief
Formidable Forms is a popular WordPress plugin used to create contact forms, surveys, and calculators on websites. An unauthenticated attacker can inject malicious scripts that are stored and executed in administrators' browsers when they access affected pages, potentially allowing account takeover or administrative actions without permission. The vulnerability is exploitable because the plugin insufficiently filters user input and an attacker can discover administrator user IDs through WordPress's public API.
Technical details
This is a Stored Cross-Site Scripting (XSS) vulnerability in the Formidable Forms plugin affecting versions up to and including 6.33.1. The vulnerability exists in the 'frm_user_id' parameter due to insufficient input sanitization and inadequate output escaping. An unauthenticated attacker can forge the frm_user_id parameter to match a target administrator's user ID (discoverable via the public WordPress REST API), and inject arbitrary JavaScript payloads. The plugin relies on wp_kses_post() as the sole output filter, which preserves the injected payload; the plugin's admin-side JavaScript then automatically decodes and executes the payload on page load. This allows arbitrary script execution in the context of logged-in administrators.
Affected products
- Formidable Formidable Forms up to and including 6.33.1
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory: CVE-2026-18331