WordPress security by component

Formidable Forms

Formidable Forms (formidable) is a WordPress plugin with 12 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 9.8.

Plugin slug: formidable

Latest vulnerability

CVE-2026-89435: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Unauthorized plugin installation

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed). The structured affected range is <= 6.35.

PublishedOct 30, 2026

Known safe version7.0

Published vulnerabilities for formidable
		Safe version
Oct 30, 2026	CVE-2026-89435 Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Unauthorized plugin installation The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 6.35 via the 'file_url' parameter parameter. This is due to insufficient URL prefix validation in validate_url_is_in_s3_bucket() and a permission callback that relies solely on a shared token obtainable by any user with the delegable frm_view_forms capability, without checking install_plugins or activate_plugins capabilities. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server. Exploitation additionally requires that the site is free-only (Formidable Pro is NOT installed). The structured affected range is <= 6.35.	7.0	CVE8.8
Sep 16, 2026	CVE-2026-19857 Formidable Forms passes request input into server-side shortcode execution Formidable Forms from 6.34 up to but not including 6.35 substitutes a request-derived value for a supported token in a form's custom HTML without preventing that value from reaching the WordPress shortcode parser. An unauthenticated visitor can cause arbitrary registered shortcodes with attacker-chosen attributes to run on a page displaying an affected form. Impact depends on the shortcodes registered on the site and their authorization checks; arbitrary PHP execution is not established. The export does not name the token, request parameter or parsing function.	6.35	CVE4.8
Sep 16, 2026	CVE-2026-85641 Formidable Forms trusts forged editor identity when filtering entry HTML Formidable Forms from 6.34 up to but not including 6.35: An unauthenticated visitor can set the identifier representing the last user to edit a form entry. The plugin trusts that identity when deciding whether to strip HTML, allowing markup that would normally be removed to appear in the administrator's entry view and falsely attributing the entry to an administrator. The export does not disclose the field, endpoint or handler, and does not establish arbitrary JavaScript execution.	6.35	CVE4.3
Aug 26, 2026	CVE-2026-18331 Formidable Forms permits unauthenticated stored cross-site scripting Formidable Forms through 6.33.1 insufficiently sanitizes and escapes frm_user_id. An unauthenticated attacker can forge the value to a publicly discoverable administrator ID; wp_kses_post() preserves the payload and Formidable's administrator JavaScript decodes and executes it automatically when the affected page loads.	6.34	CVE7.2
Mar 13, 2026	CVE-2026-2890 Formidable Forms: A security weakness Formidable Forms is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE7.5
Mar 13, 2026	CVE-2026-2888 Formidable Forms: Cross-site request forgery Formidable Forms is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE5.3
Nov 23, 2024	CVE-2024-11188 Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-site scripting Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.1
Oct 16, 2024	CVE-2017-20192 Formidable Form Builder: Cross-site scripting Formidable Form Builder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE8.3
Jul 31, 2024	CVE-2024-6725 Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder: Cross-site scripting Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder is affected by cross-site scripting. Exploitation requires an authenticated WordPress account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE4.9
May 17, 2024	CVE-2024-23522 Formidable Forms: Cross-site scripting Formidable Forms is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.3
Feb 28, 2023	CVE-2023-24419 Formidable: Cross-site request forgery Formidable is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE7.1
Aug 29, 2019	CVE-2019-15780 Formidable: Code execution Formidable is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVEPending

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers