Formidable Forms trusts forged editor identity when filtering entry HTML
Formidable Forms from 6.34 up to but not including 6.35: An unauthenticated visitor can set the identifier representing the last user to edit a form entry. The plugin trusts that identity when deciding whether to strip HTML, allowing markup that would normally be removed to appear in the administrator's entry view and falsely attributing the entry to an administrator. The export does not disclose the field, endpoint or handler, and does not establish arbitrary JavaScript execution.
- Component
- Formidable Forms
- Plugin slug
formidable- Affected
- 6.34 to < 6.35
- Safe version
6.35- Published
- Sep 16, 2026
This CVE was published Sep 16, 2026 and is one of 12 known issues for this plugin.
Update, patch or deactivate.
Update Formidable Forms to 6.35 or later. Derive editor identity from the authenticated actor, not submitted metadata, and base HTML permissions on that actor's real capabilities. Escape entry values in the admin view and review forged attribution or stored markup safely.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Formidable Forms WordPress plugin before 6.35 does not restrict who can set the identifier recording which user last edited a form entry, and relies on that identifier when deciding whether to strip HTML from stored entry values, allowing unauthenticated visitors to have markup rendered in the admin entry view that would otherwise be removed, and to attribute their submission to an administrator who never made it.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N