What’s Vulnerable › Products

Formidable Forms vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Formidable Forms version is affected

Latest Formidable Forms vulnerabilities

• CVE-2026-85642 — Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS (CVSS 7.5)
• CVE-2026-19857 — Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token (CVSS 4.8)
• CVE-2026-85641 — Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter (CVSS 4.3)
• CVE-2026-11361 — Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status (CVSS 5.9)
• CVE-2022-45806 — WordPress Formidable Forms plugin <= 5.5.4 - Broken Access Control vulnerability (CVSS 9.8)
• CVE-2024-11188 — Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter (CVSS 6.1)
• CVE-2024-9768 — Formidable Forms < 6.14.1 - Admin+ Stored XSS (CVSS 4.8)
• CVE-2024-6725 — Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4)
• CVE-2024-23522 — WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability (CVSS 6.1)
• CVE-2024-0660 — Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 4.3)
• CVE-2023-1405 — Formidable Forms < 6.2 - Unauthenticated PHP Object Injection (CVSS 7.5)
• CVE-2023-2877 — Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution (CVSS 8.8)