Is CVE-2026-18331 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18331 being exploited in the wild.

How severe is CVE-2026-18331?

High severity, with a CVSS score of 7.2, published 26 August 2026.

Which products and versions are affected?

Formidable Forms up to and including 6.33.1.

Is there a fix for CVE-2026-18331?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-18331 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18331?

Check whether you run Formidable Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18331: Formidable Forms Stored Cross-Site Scripting via frm_user_id parameter

CVE-2026-18331 · Severity: high · CVSS 7.2 · Published 2026-08-26

Formidable Forms is a popular WordPress plugin used to create contact forms, surveys, and calculators on websites. An unauthenticated attacker can inject malicious scripts that are stored and executed in administrators' browsers when they access affected pages, potentially allowing account takeover or administrative actions without permission. The vulnerability is exploitable because the plugin insufficiently filters user input and an attacker can discover administrator user IDs through WordPress's public API.

Technologies: Formidable Forms. Vendors: Formidable.

Quick answers

Is CVE-2026-18331 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18331 being exploited in the wild.
How severe is CVE-2026-18331?: High severity, with a CVSS score of 7.2, published 26 August 2026.
Which products and versions are affected?: Formidable Forms up to and including 6.33.1.
Is there a fix for CVE-2026-18331?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-18331 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18331?: Check whether you run Formidable Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability in the Formidable Forms plugin affecting versions up to and including 6.33.1. The vulnerability exists in the 'frm_user_id' parameter due to insufficient input sanitization and inadequate output escaping. An unauthenticated attacker can forge the frm_user_id parameter to match a target administrator's user ID (discoverable via the public WordPress REST API), and inject arbitrary JavaScript payloads. The plugin relies on wp_kses_post() as the sole output filter, which preserves the injected payload; the plugin's admin-side JavaScript then automatically decodes and executes the payload on page load. This allows arbitrary script execution in the context of logged-in administrators.

Affected products

Formidable Formidable Forms up to and including 6.33.1

Timeline

2026-08-26: disclosed
2026-08-26: advisory: CVE-2026-18331

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.