Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More

Information

Software Type Plugin
Software Slug formidable (view on wordpress.org)
Software Status Active
Software Author strategy11team
Software Website formidableforms.com
Software Downloads 27,923,008
Software Active Installs 300,000
Software Record Last Updated October 10, 2026

Showing 1-20 of 27 Vulnerabilities

Submit a Vulnerability
Formidable Forms <= 6.34 - Unauthenticated Content Injection
5.3
CVE-2026-85641
Sep 14, 2026
Researcher: Karthik Ramakrishnan
Formidable Forms <= 6.34 - Unauthenticated Arbitrary Shortcode Execution
6.5
CVE-2026-19857
Sep 14, 2026
Researcher: Jakub Herman
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
7.2
CVE-2026-18331
Aug 25, 2026
Researcher: daroo
Formidable Forms <= 6.32.0 - Unauthenticated Payment Bypass
5.3
CVE-2026-11361
Jun 25, 2026
Researcher: Yaswanth Reddy Sunkara
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
5.3
CVE-2026-2888
Mar 12, 2026
Researcher: Michael Iden (Mickhat)
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
7.5
CVE-2026-2890
Mar 12, 2026
Researcher: Andrés Cruciani
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter
6.1
CVE-2024-11188
Nov 22, 2024
Researcher: mikemyers
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2024-9768
Oct 31, 2024
Researcher: Krugov Artyom
Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
4.9
CVE-2024-6725
Jul 30, 2024
Researcher: zer0gh0st
Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
CVE-2024-0660
Jan 26, 2024
Researcher: Webbernaut
Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2023-6842
Jan 8, 2024
Researcher: drop
Formidable Forms <= 6.7 - HTML Injection
6.5
CVE-2023-6830
Jan 8, 2024
Researcher: drop
Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation
6.5
CVE-2023-2877
May 31, 2023
Researcher: Alex Sanford
Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection
9.8
CVE-2023-1405
Apr 6, 2023
Researcher: Nguyen Huu Do
Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header
5.3
CVE-2023-0816
Mar 6, 2023
Researcher: Daniel Ruf
Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery
7.1
CVE-2023-24419
Feb 1, 2023
Researcher: Rafshanzani Suhada
Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery
4.7
CVE ID Unknown
Dec 16, 2022
Researchers:
Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery
5.4
CVE-2022-45806
Dec 16, 2022
Researcher: István Márton
Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting
4.8
CVE-2021-24608
Oct 6, 2021
Researcher: Asif Nawaz Minhas
Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting
9.6
CVE-2021-24884
Jan 28, 2021
Researcher: Maximilian Barz
Title Status CVE ID CVSS Researchers Date
Formidable Forms <= 6.34 - Unauthenticated Content Injection Patched CVE-2026-85641 5.3 Karthik Ramakrishnan September 14, 2026
Formidable Forms <= 6.34 - Unauthenticated Arbitrary Shortcode Execution Patched CVE-2026-19857 6.5 Jakub Herman September 14, 2026
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter Patched CVE-2026-18331 7.2 daroo August 25, 2026
Formidable Forms <= 6.32.0 - Unauthenticated Payment Bypass Patched CVE-2026-11361 5.3 Yaswanth Reddy Sunkara June 25, 2026
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter Patched CVE-2026-2888 5.3 Michael Iden (Mickhat) March 12, 2026
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse Patched CVE-2026-2890 7.5 Andrés Cruciani March 12, 2026
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter Patched CVE-2024-11188 6.1 mikemyers November 22, 2024
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting Patched CVE-2024-9768 4.4 Krugov Artyom October 31, 2024
Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting Patched CVE-2024-6725 4.9 zer0gh0st July 30, 2024
Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting Patched CVE-2024-0660 6.1 Webbernaut January 26, 2024
Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting Patched CVE-2023-6842 4.4 drop January 8, 2024
Formidable Forms <= 6.7 - HTML Injection Patched CVE-2023-6830 6.5 drop January 8, 2024
Formidable Forms <= 6.3 - Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation Patched CVE-2023-2877 6.5 Alex Sanford May 31, 2023
Formidable Forms <= 6.1.2 - Unauthenticated PHP Object Injection Patched CVE-2023-1405 9.8 Nguyen Huu Do April 6, 2023
Formidable Forms <= 6.0.1 - IP Spoofing via HTTP header Patched CVE-2023-0816 5.3 Daniel Ruf March 6, 2023
Formidable Form Builder <= 5.5.6 - Cross-Site Request Forgery Patched CVE-2023-24419 7.1 Rafshanzani Suhada February 1, 2023
Formidable Forms <= 5.5.4 - Authenticated (Admin+) Server-Side Request Forgery Patched 4.7 December 16, 2022
Formidable Form Builder <= 5.5.4 - Cross-Site Request Forgery Patched CVE-2022-45806 5.4 István Márton December 16, 2022
Formidable Form Builder <= 5.0.06 - Admin+ Stored Cross-Site Scripting Patched CVE-2021-24608 4.8 Asif Nawaz Minhas October 6, 2021
Formidable Form Builder <= 4.09.04 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2021-24884 9.6 Maximilian Barz January 28, 2021

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation